Free tools Windows power users keep installed
One-click scans. No signup required.
Put Nginx at the public HTTPS endpoint, forward each request to the correct WordPress backend, and preserve the original host, scheme, and client address. The details that prevent most failures are choosing proxy_pass for an HTTP backend or fastcgi_pass for PHP-FPM, configuring WordPress to recognize HTTPS behind the proxy, and adding Nginx’s own permalink fallback.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a WordPress reverse proxy does
A reverse proxy accepts the visitor’s request, sends it to an upstream server, receives the upstream response, and returns that response to the visitor. Nginx can therefore be the public web server while WordPress runs on Apache, another HTTP server, or directly on PHP-FPM. The browser sees one public hostname; the backend can remain on a private address.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →There are two materially different designs:
| Design | Nginx’s job | WordPress execution | Where rewrites live | Typical failure boundary |
|---|---|---|---|---|
| Nginx in front of Apache or another HTTP server | TLS termination, headers, proxying, and optionally static-file or response caching | Backend HTTP server invokes PHP and serves WordPress | Nginx must handle proxy behavior; Apache may still handle its own application rewrites | Nginx-to-backend connectivity, protocol, and forwarded headers |
| Nginx directly with PHP-FPM | Static files, URL fallback, TLS, headers, and FastCGI requests | PHP-FPM executes WordPress scripts | Nginx configuration; there is no automatic .htaccess processing |
PHP-FPM socket, script paths, permissions, and Nginx routing |
Many installations described as using Nginx actually use Apache behind it. Standalone Nginx has no directory-level equivalent to Apache’s .htaccess, and WordPress cannot write Nginx rules automatically. Rewrite ownership must be deliberate rather than assumed.
Choose the topology before writing configuration
Use Nginx as a proxy to Apache when
- The existing WordPress site already works on Apache and you want a public TLS endpoint, centralized headers, or a separate edge server.
- Plugins or operational tools depend on Apache behavior and you do not want to reproduce those rules in Nginx immediately.
- The proxy and application server are separate machines or containers and the backend should not be directly reachable from the Internet.
Use direct Nginx plus PHP-FPM when
- You want one web server to serve static assets and route PHP requests without an intermediate HTTP hop.
- You are prepared to maintain permalink, security, upload, and cache rules in Nginx configuration.
- You can identify the correct PHP-FPM socket or TCP endpoint and ensure Nginx has permission to use it.
Single server or split servers
A single host is simpler to operate but puts Nginx, WordPress files, and PHP-FPM in one failure domain. A split topology makes the backend addressable privately and lets you scale or isolate components, but adds firewall, DNS, health-check, and network troubleshooting. In either design, bind the backend to a private interface or local socket when public access is unnecessary.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare DNS, TLS, and the backend
- Point the public DNS name to the Nginx host. Do this before testing redirects so the browser reaches the intended proxy.
- Install the certificate and private key on Nginx. The certificate must cover the exact public hostname visitors use.
- Confirm which protocol the upstream speaks. An Apache or application server listening for HTTP requires
proxy_pass; a PHP-FPM socket or FastCGI TCP listener requiresfastcgi_pass. Do not substitute one for the other. - From the Nginx host, verify that the backend address, port, or socket exists and is reachable. For a split server, allow only the proxy’s source address through the backend firewall.
- Record the actual WordPress document root and PHP-FPM socket path. Socket names vary with the installed PHP version and distribution.
You can terminate TLS at Nginx and send HTTP over a trusted private network, or use TLS from Nginx to the backend as well. End-to-end TLS reduces exposure on an untrusted network but requires backend certificates, verification policy, and matching upstream protocol settings. Do not configure an HTTPS upstream merely because the public side is HTTPS.
Configuration A: Nginx proxying to an HTTP WordPress server
Define the upstream and public HTTPS server
The following is a complete pattern. Replace the example hostname, certificate paths, and backend address with values from your installation; the backend in this example listens for HTTP on port 8080.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11upstream wordpress_backend {
server 127.0.0.1:8080;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/private.key;
location / {
proxy_pass http://wordpress_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
}
}proxy_pass points to an HTTP upstream. The forwarded headers retain the public host, the original client address, the proxy chain, and whether the visitor used HTTP or HTTPS. Nginx changes the upstream Host and Connection values by default, so setting the host explicitly prevents redirects and generated links to an internal name.
If the backend is on another machine, use its private address in the upstream block and permit that address through the backend firewall. If the backend itself serves HTTPS, use an https:// upstream and configure certificate verification and the expected SNI name rather than silently ignoring certificate errors.
Redirect HTTP to the public HTTPS URL
Keep a separate port-80 server that performs only the canonical redirect. It should redirect to the public hostname, not to the backend address.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
server {
listen 80;
server_name example.com;
return 301 https://example.com$request_uri;
}When a site supports more than one canonical hostname, choose one and redirect the others consistently. Inconsistent host handling is a common cause of apparent loops.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBackend expectations
- The backend must accept the public host or be configured with an equivalent virtual host. Otherwise it may issue redirects to an internal hostname.
- Backend access logs should record the forwarded address if you need meaningful client-IP audit trails.
- Do not expose the backend port publicly when Nginx is intended to be the only entry point.
- If the backend generates absolute URLs, it must receive the original host and scheme or be given equivalent trusted settings.
Configuration B: Nginx serving WordPress with PHP-FPM
In this design Nginx serves existing files directly, sends PHP scripts to PHP-FPM, and routes non-file WordPress URLs to index.php. The socket path below is illustrative; use the path installed on the server.
server {
listen 443 ssl;
server_name example.com;
root /var/www/example;
index index.php;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/private.key;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTP_PROXY '';
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}
server {
listen 80;
server_name example.com;
return 301 https://example.com$request_uri;
}try_files serves a real image, stylesheet, or other file without invoking PHP. For a pretty permalink that is not a real file, it passes the request and query string to WordPress’s front controller. fastcgi_pass is reserved for FastCGI services such as PHP-FPM; it is not a replacement for proxy_pass.
Check the PHP-FPM boundary
- Make sure the PHP-FPM service is running and listening on the configured socket or TCP address.
- Ensure the Nginx worker user can traverse the socket’s parent directory and connect to the socket.
- Use the actual document root in
SCRIPT_FILENAME; an incorrect root commonly produces “File not found” responses. - Keep the PHP location narrow enough that uploaded files or arbitrary non-PHP data are not executed as scripts.
Make WordPress understand the public HTTPS URL
When TLS ends at Nginx, the connection from Nginx to an HTTP backend is not itself encrypted. WordPress must rely on the trusted X-Forwarded-Proto value to know that the visitor used HTTPS. If it believes the request is HTTP while the browser is on HTTPS, it can redirect repeatedly or emit insecure asset links.
Set the WordPress Site Address and WordPress Address to the same public scheme and hostname you intend to use. You can set them in the administrator’s General Settings when the dashboard is usable, or define the corresponding URL constants in wp-config.php for a controlled deployment. Do not leave one URL pointing at an internal host or an HTTP variant.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
A common PHP-FPM or Apache-side pattern is to translate the forwarded scheme for trusted proxy traffic:
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
$_SERVER['HTTPS'] = 'on';
}Apply this only when requests can reach WordPress through a proxy you control. If arbitrary Internet clients can inject the header directly, trusting it would let them impersonate an HTTPS request. In a multi-proxy chain, establish which hop is trusted and normalize the value there.
After changing URLs, clear any application or page cache and test both the front end and the login flow. A cached redirect can make a corrected configuration appear broken.
Reproduce WordPress permalink behavior in Nginx
Apache installations often obtain rewrite behavior from .htaccess. Nginx does not read that file, so a direct-Nginx site needs an explicit fallback such as try_files $uri $uri/ /index.php?$args;. Without it, the home page and static files may work while posts, pages, or custom taxonomies return 404.
For a proxy-to-Apache design, decide which layer owns rewrites. If Apache is already the WordPress web server, let it process its application rules and keep Nginx’s location block focused on forwarding. If Nginx serves files directly or intercepts a path before Apache, put the equivalent rule in Nginx and test every custom post type and language or membership path used by the site.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Do not copy an arbitrary rewrite snippet without checking its interaction with subdirectories, multisite, REST endpoints, or existing locations. A rule that sends every URI to the wrong document root can break static assets and administrative requests.
Forward client identity and request context safely
Use the standard forwarding set consistently:
Host $hostpreserves the public host used for routing and URL generation.X-Real-IP $remote_addrsupplies the address seen by Nginx.X-Forwarded-For $proxy_add_x_forwarded_forappends Nginx’s observation to an existing proxy chain.X-Forwarded-Host $server_namecommunicates the selected public server name.X-Forwarded-Proto $schemecommunicates HTTP versus HTTPS at the edge.proxy_redirect offprevents Nginx from rewriting redirects unexpectedly; use explicit redirect rules when a backend emits an incorrect location.
The backend must be configured to trust these headers only from known proxy addresses. Otherwise a client can submit a forged X-Forwarded-For value and pollute logs, rate limits, or security decisions. If there are several proxies, document the order and ensure only the edge appends or replaces the values your application uses.
Add caching only after the uncached site is correct
Nginx can cache responses, but caching changes correctness responsibilities. A cached page can hide an edit, preserve an old comment form, or serve one user’s state to another if bypass rules are incomplete.
FastCGI cache for direct PHP-FPM
A FastCGI cache uses a cache zone, a cache key, and explicit bypass conditions. The exact cookie names and exclusions depend on the site’s plugins and authentication model, so treat the following as a design checklist rather than a universal drop-in:
- Skip caching for administrator paths, login requests, POST and other state-changing methods.
- Skip requests carrying logged-in or session cookies.
- Do not cache responses that set private session cookies or contain user-specific data.
- Define how publishing, updating, commenting, and plugin actions purge affected URLs.
- Set stale-response behavior deliberately; stale content should not conceal an origin outage or an urgent update without an operational reason.
WordPress guidance describes a cache zone, cache key, stale-response controls, and purge integration such as the Nginx Helper plugin. The purge mechanism must match the cache layer and the site’s URL structure; enabling a cache without a purge plan leaves readers with stale pages after edits.
Proxy caching for an Apache backend
When Nginx fronts Apache, use proxy-cache directives rather than FastCGI directives. The same exclusions apply: do not cache logged-in sessions, administrator pages, POST requests, or other state-changing requests. Test cache headers and bypass decisions with an anonymous browser and a logged-in browser before enabling broad caching.
When to leave caching off
Uncached operation is often the right first milestone for a new migration, a highly personalized site, or a site whose purge behavior has not been verified. It is easier to diagnose because every response reflects the current backend. Add caching only when you can explain the cache key, bypass conditions, invalidation trigger, and expected response headers.
Validate the migration in a controlled order
- Run the local Nginx syntax test, normally
nginx -t, and correct every reported error before reloading. - Reload Nginx using the service manager used by the host. A successful reload means the configuration parsed; it does not prove that WordPress works.
- Request the public home page over HTTPS and confirm that the certificate, hostname, and page source are correct.
- Open a known pretty permalink, a static image or stylesheet, and a URL with a query string.
- Open
/wp-admin/, sign in, and verify that the login redirect returns to the public HTTPS hostname. - Publish or edit a harmless test item, then confirm that the front end reflects it. If caching is enabled, verify the purge event rather than merely refreshing the browser.
- Inspect Nginx and backend logs for the public host, expected client-IP chain, response status, and upstream timing.
- Test from outside the backend network to ensure the backend port is not accidentally exposed.
Use a command-line request when browser behavior is ambiguous. A request to the public hostname should show the expected status and Location header without revealing an internal hostname.
Troubleshoot by symptom
Redirect loop or HTTP links on an HTTPS site
- Confirm Nginx sends
X-Forwarded-Proto $scheme. - Confirm WordPress or its web server converts a trusted forwarded HTTPS value into its HTTPS state.
- Check that both WordPress URL settings use the public HTTPS URL.
- Look for a second proxy or load balancer that overwrites the scheme.
Redirects to an internal hostname or wrong domain
- Preserve
Host $hostand provide the public forwarded host. - Check the backend virtual-host selection and WordPress URL settings.
- Inspect the raw
Locationheader to identify whether Nginx, the backend, or WordPress generated the redirect.
Logs show the proxy address instead of the visitor
- Pass both
X-Real-IPandX-Forwarded-For. - Configure the backend, application, and log parser to trust those headers only from the proxy’s address.
- In a chain, remove or normalize untrusted client-supplied forwarding values at the edge.
Pretty permalinks return 404
- For direct Nginx, add the
try_filesfallback toindex.php. - For Apache behind Nginx, verify that the request reaches the intended Apache virtual host and that its rewrite rules are active.
- Check that a more-specific Nginx location is not intercepting the path before the fallback.
502 Bad Gateway
- For
proxy_pass, verify the upstream address, port, protocol, DNS resolution, and firewall. - For
fastcgi_pass, verify that PHP-FPM is running, the socket or TCP listener matches the configuration, and socket permissions allow Nginx to connect. - Read the Nginx error log for connection refused, timeout, or permission-denied details; each points to a different boundary.
- Check that you did not use a FastCGI directive for an HTTP backend or an HTTP proxy directive for a PHP-FPM socket.
Pages remain stale after editing
- Determine whether the stale response comes from Nginx, a plugin, a CDN, or the browser.
- Review bypass conditions for logged-in users and administrative paths.
- Test the configured purge integration, including edits, comments, and taxonomy changes.
- Temporarily disable page caching while correcting the purge process.
Operational practices that prevent regressions
- Keep Nginx configuration in version control and record which layer owns redirects, rewrites, TLS, headers, and caching.
- Use a staging hostname or maintenance window to test login, uploads, REST requests, scheduled tasks, and plugin-specific URLs before switching DNS.
- After changing PHP versions, re-check the PHP-FPM socket path and permissions; package upgrades can change both.
- Renew certificates before expiry and reload Nginx only after validating the resulting configuration.
- Monitor both edge and backend logs. A 200 response from Nginx can still represent an application error page, while a 502 identifies an upstream boundary problem.
- Document trusted proxy addresses so a future administrator does not accept spoofed forwarding headers.
Decision summary
For an existing Apache WordPress site, proxy it with proxy_pass, preserve the public host and scheme, and let the backend retain its application behavior. For a new or deliberately simplified stack, serve files with Nginx, route PHP through fastcgi_pass, and add the explicit WordPress front-controller fallback. In both cases, configure HTTPS detection and canonical URLs before diagnosing redirects, and postpone full-page caching until bypass and purge behavior have been proven.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
