Nginx for WordPress with PHP-FPM: a complete, safe config

1. Install PHP and the extensions

sudo apt install nginx php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-xml php-zip php-imagick
php -v
systemctl list-units 'php*-fpm*' --no-pager
ls /run/php/

The number in the socket’s name has to match your PHP version, so change php8.3-fpm.sock in the config if yours differs. That’s a classic reason for a 502.

snippets/fastcgi-php.conf comes with Nginx on Debian and Ubuntu. On RHEL, the PHP package adds /etc/nginx/default.d/php.conf, and the socket is /run/php-fpm/www.sock.

2. Set the limits together

Nginx and PHP each limit uploads, and the lowest wins. So set all of them in /etc/php/8.3/fpm/php.ini:

upload_max_filesize = 64M
post_max_size = 64M
memory_limit = 256M
max_execution_time = 120

sudo systemctl restart php8.3-fpm

An upload over the limit fails with 413 Request Entity Too Large, or in WordPress with a message about exceeding upload_max_filesize.

3. Permissions

WordPress runs as www-data, and only needs to write in wp-content:

sudo chown -R root:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 750 {} +
sudo find /var/www/example.com -type f -exec chmod 640 {} +
sudo chown -R www-data:www-data /var/www/example.com/wp-content

This stops a hacked plugin from rewriting WordPress itself. Automatic core updates can’t write there either, so either update with WP-CLI, or give www-data the whole folder and accept that risk. The chmod Calculator explains these numbers. chmod 777 is never the answer.

4. Get HTTPS, and turn it on

sudo certbot certonly --standalone -d example.com -d www.example.com \
  --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

If that fails, see Certbot failed to authenticate. Then set the address in WordPress, under Settings → General, or in wp-config.php:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

5. Behind Cloudflare or a load balancer

WordPress can’t see that the visitor used HTTPS, so it redirects forever, and shows ERR_TOO_MANY_REDIRECTS. Add this near the top of wp-config.php:

if (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

Also read Too many redirects, since Cloudflare’s SSL mode matters too.

6. Block what you don’t use

If you don’t use the mobile app or Jetpack, XML-RPC is mostly a target for password guessing. Add this to the server block:

location = /xmlrpc.php {
    deny all;
}