I run a couple of WordPress sites on a cloud server that I own. All of these sites run on the same Apache installation. Recently, I've found that in all of my WordPress webroot folders, an empty file called nginx.conf has appeared.

Should I be concerned (about a security breach)? I don't think WordPress creates an nginx.conf file on the webroot when updating or being installed. But I can't find anything about this on Google.

  • If you haven't already it's probably worth grepping your entire installation, including wp-content for plugins and theme, for nginx.conf to see if any of those might be doing it. I guess this is entirely self-hosted, i.e. you don't have WP Engine's mu-plugin or similar? Can you tell anything from the file ownership - i.e. was it written by the apache user - and timestamps on these files? If you delete them and update something do they come back? (e.g. you could clone a site and then update it to a beta channel if you're already on 5.1.1)
    – Rup
    Commented Mar 13, 2019 at 17:26
  • 1
    Thanks for suggesting to grep my entire installation. I found the issue. I have the iThemes Security plugin installed on all my WordPress sites, and this causes nginx.conf to be created in the root folders when certain config settings are run.
    – John Doe
    Commented Mar 14, 2019 at 3:33

1 Answer 1


Late to the party but if anyone finds this as a result of a search.

this will have been auto-created when you installed Ithemes security.

By default, it will create an Nginx.conf file in the site public_html folder you can change the location of this file in the settings.

If it is on apache it shouldn't really do this though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.