Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

BACKGROUND:

Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was able to successfully get my first Wordpress site running. Now I want to know what I should do (or at least get some experienced recommendations for what I should consider doing) beyond the Guides.

QUESTION:

What further configuration should I implement to produce the most solid, reliable, secure, and fast Wordpress sites that I plan on hosting?

A few of the areas I'm particulary concerned about:

  1. What permissions should I set on each of wp folders? Users will need to upload various assets (images, pdfs, office docs, audio, video). I found this article here that seems helpful, but would like to get some input from folks having done this?

  2. What is the/a recommended configuration for nginx? Below is mine, but as I'm new to nginx I'm not all that confident that I have the best configuration of if it is even a good one. What can/should be done to improve it?

  3. w3 Total Cache or WP Supercache? What are the better/best caching options and how are folks managing their cache? As I'm running on an ummanaged server, perhaps there are other suggestions?

  4. How do you set up a CDN and what should you put up in it? I have an Amazon S3 account to use, just not sure how it should be used?

  5. What should I use to perform and manage backups of Wordpress sites (content and database)?

  6. What should I install for a robust security infrastructure?

  7. What should I be using to monitor the performance and potential problems (whether it be performance or security breaches)?

  8. Generally speaking, in what ways should folks deviate from the Guides?

  9. Any other recommendations???

MY CURRENT NGINX CONFIG:

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;
        gzip_disable "msie6";
        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/x-javascript text/xml 
        application/xml application/xml+rss text/javascript;

        ##
        # nginx-naxsi config
        ##
        # Uncomment it if you installed nginx-naxsi
        ##

        #include /etc/nginx/naxsi_core.rules;

        ##
        # nginx-passenger config
        ##
        # Uncomment it if you installed nginx-passenger
        ##

        #passenger_root /usr;
        #passenger_ruby /usr/bin/ruby;

        ##
        # Virtual Host Configs
        ##


        port_in_redirect off;

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;

        server {
                server_name www.mydomain.com mydomain.com;
                access_log /srv/www/mydomain.com/logs/access.log;
                error_log /srv/www/mydomain.com/logs/error.log;
                root /srv/www/mydomain.com/public_html;
                index index.html index.htm index.php

                include conf.d/drop;

                location / {
                        # This is cool because no php is touched for static content
                        try_files $uri $uri/ /index.php?q=$uri&$args;
                }

                location ~ \.php$ {
                        try_files $uri =404;
                        include /etc/nginx/fastcgi_params;
                        fastcgi_pass 127.0.0.1:9000;
                        fastcgi_index index.php;
                        fastcgi_param SCRIPT_FILENAME   
                           /srv/www/mydomain.com/public_html$fastcgi_script_name;
                }
        }
}

Thanks!

share|improve this question
4  
Those are a ton of questions... –  kaiser Jan 8 '13 at 20:25
    
Agreed. Updated to reduce it to a single question. Could turn this into 10 questions but kind of hoping this thread might become a useful, one-top, destination for folks wanting to know where to go next. –  wgpubs Jan 8 '13 at 23:52
    
Still a lot of questions that applies to any server stack, not just nginx based servers running WordPress. –  Pothi Jan 9 '13 at 3:21
add comment

closed as too broad by toscho Nov 21 '13 at 0:37

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

What permissions should I set on each of wp folders? Users will need to upload various assets (images, pdfs, office docs, audio, video). I found this article here that seems helpful, but would like to get some input from folks having done this?

This will be the same as any other web server. Whatever user happens to be running the web server need permission to access the files its meant to serve. With PHP-FPM backing the PHP portion of things, its user will need access to the PHP files. Generally both PHP-FPM and Nginx will run under the same user, but that's really up to you.

SO! Let's say both Nginx and PHP-FPM are running under www-data. Your document root and its file should be readable by that user. If I'm running a server for a client, I'm likely to use a deploy user for scripted/automated deployments, so that probably means that the files will be group readable/writeable. Eg 775 permissions.

What is the/a recommended configuration for nginx? Below is mine, but as I'm new to nginx I'm not all that confident that I have the best configuration of if it is even a good one. What can/should be done to improve it?

There are a few repos on github that you should take a look at:

https://github.com/perusio/wordpress-nginx

https://github.com/pothi/WordPress-Nginx

Both have pretty good example of Nginx config files.

What you have looks like the default Ubuntu install config. A few things to keep in mind:

  1. Nginx is fast. Like stupid fast. If you're not doing anything crazy CPU intensive (ala serving SSL) a single worker process should be fine. But you can bump it up to something equal to the number of CPU cores.
  2. worker_connections has some good info in the docs that you should take a look at regarding max clients your server can handle
  3. limit_conn_zone and limit_zone present some interesting things to help mitigate traffic spikes. They are also incredible hard to tweak and get right. Use caution!
  4. Utilize browser caching and set Expires headers. THere are no per-directory config files like .htaccess in nginx where you can control caching headers. Be sure to do it in your server config.
  5. Be sure to look into the gzip module and understand what the directives do and if you need to modify anything. Especially gzip_types, which only defaults to text/html.
  6. If at all possible, try using a unix socket to pass PHP files off to FPM. I've better luck with this than listing on a localhost port.

w3 Total Cache or WP Supercache? What are the better/best caching options and how are folks managing their cache? As I'm running on an ummanaged server, perhaps there are other suggestions?

I would suggest not doing this until you are sure you need to. If you're on a server to which you have complete access, I would be included to do full page caching back by something like a persistent object cache and batcache.

How do you set up a CDN and what should you put up in it? I have an Amazon S3 account to use, just not sure how it should be used?

S3 is not a CDN. So you want your images to live elsewhere? Then use S3 + CloudFront with S3 as the origin to server files.

If you want a super simple CDN, set up an "origin pull" CDN that fetches file from your server, respects their cache headers and refresh based on that, and servers files for you. This is is incredible easy to set up.

What should I use to perform and manage backups of Wordpress sites (content and database)?

I am a super-nerd, so I use automated scripts (written with fabric Fabric) to just SSH in do a mysqldump and then download the SQL dump. Rsync is speedy to grab static files, but you could also just tarball a snapshot of the media and download it.

Obviously there are other solutions to this issue. Vaultpress, etc. Look around.

What should I install for a robust security infrastructure?

Password-less SSH. And, since you're in control of the box you can have WordPress use bcrypt to hash passwords to make them slightly more secure.

Other than that, the usual stuff applies: good password and grant permissions appropriately -- both in WP and on the server itself.

What should I be using to monitor the performance and potential problems (whether it be performance or security breaches)?

Take your pick. Look around. See what you need to monitor. There are uptime monitors, system performance monitoring solutions. Too broad of a question.

Generally speaking, in what ways should folks deviate from the Guides?

When the guidelines don't work for you.

Most of the follow ups to these questions would be better suited to a site like ServerFault, by the way.

share|improve this answer
add comment

I really know nothing about Nginx, but here are some maybe useful sources. Not everthing is in English, but Google Translator should work on this.

Then there's also the here on the site.

share|improve this answer
add comment

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast?

Nginx can not run WordPress without the help of php-fpm or Apache (that needs another PHP handler anyway). If we use Apache with Nginx, all the best practices that apply to an Apache server would apply for Nginx too. Of course, there is more to it.

What further configuration should I implement to produce the most solid, reliable, secure, and fast Wordpress sites that I plan on hosting?

Each WordPress site requires specific tweaking in terms of security, reliability and performance. We never knew what you plan on hosting in the future. Most importantly, things change almost all the time. For example, Akismet has introduced a .htaccess file since 2.5.7 to block direct access to files. If we are not going to be on top of all these, any recommendation that apply now would only apply for now.

What permissions should I set on each of wp folders? Users will need to upload various assets (images, pdfs, office docs, audio, video). I found this article here that seems helpful, but would like to get some input from folks having done this?

Rule of thumb for any server stack (irrespective of the applications deployed in it) is to start with the minimal permission and see if it works. From there you can go upwards until everything works.

What is the/a recommended configuration for nginx? Below is mine, but as I'm new to nginx I'm not all that confident that I have the best configuration of if it is even a good one.

Each site requires a different configuration. A site with "www" prefix in the domain name would have a different configuration than a site without "www" prefix, due to performance reason. A site with "SSL" enabled would have a different configuration than a non-ssl site. A multisite network (subdomain / subdirectory) has a completely different configuration.

What can/should be done to improve it?

You may want to learn the best practices that are written by people who are experts in that field. If an SEO guru writes about Nginx (or WordPress) security, it may be incorrect or incomplete or even completely wrong with security holes in it. :) A good starting point is the Nginx mailing list. A couple of books available on Nginx too.

w3 Total Cache or WP Supercache? What are the better/best caching options and how are folks managing their cache? As I'm running on an ummanaged server, perhaps there are other suggestions?

Both W3 Total Cache and WP Supercache work just fine with Nginx/PHP-FPM and Nginx/Apache. So does Batcache (with APC or Memcache). As you run an unmanaged server, I'd recommend Varnish cache that may still not be suitable for all the sites, for example, e-commerce sites. Choosing the right cache depends entirely on the individual sites. This may also require some trial and error on various caching techniques. Oh, I forgot to mention that Nginx has built-in caching mechanism too (for both fastcgi and proxy configurations).

What should I use to perform and manage backups of Wordpress sites (content and database)?

I use and highly recommend RubyGem Backup for non-critical and small sites.

What should I be using to monitor the performance and potential problems (whether it be performance or security breaches)?

I use and recommend Zabbix for monitoring. There are plenty of other choices available too.

I could not answer other questions, due to time constraint. Sorry. :(

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.