I am sorry for the late reply but after reading through and doing lots of testing I have just decided to deal with it, going through everything and doing everything I could possibly think of I decided to make an ENTIRELY SEPARATE AND NEW website testing environment just with similar nginx rules and this STILL happens, which means its not nginx but wordpress. Since the wordpress is a clean install the last thing it could be is the plugin, I feel really bad about this bad news but that just looks like that’s how it is going to be. I really like this plugin and hope i can find a compromise with the configurations on this but for now i will leave the nginx configurations here for anyone to be able to replicate this. I really hope this gets fixed but I somewhat don’t have any hope for it to get fixed at this time since nothing has really helped.
configurations for docker container nginx:1.21.6-alpine
nginx/conf.d/example.com.conf:
server {
listen 0.0.0.0:443 ssl http2 reuseport;
server_name example.com www.example.com;
set $base /var/www/html;
root /var/www/html/example;
# SSL
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
proxy_busy_buffers_size 512k;
proxy_buffers 4 512k;
proxy_buffer_size 256k;
fastcgi_buffers 16 256k;
fastcgi_buffer_size 256k;
include /var/www/html/example/hidemywpghost.conf;
# security
include nginxconfig.io/security.conf;
# index.php
index index.php;
# index.php fallback
location / {
try_files $uri $uri/ /index.php?$query_string;
}
# additional config
include nginxconfig.io/general.conf;
include nginxconfig.io/wordpress.conf;
# handle .php
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php-socket.sock;
fastcgi_index index.php;
fastcgi_param PHP_VALUE "upload_max_filesize = 5120M \n post_max_size=5124M"; #just for testing purposes ignore the large file size, this can be changed without any interference
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /var/www/html/example$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_intercept_errors on;
}
include nginxconfig.io/letsencrypt.conf;
}
# HTTP redirect
server {
listen 0.0.0.0:80 reuseport;
server_name example.com *.example.com;
include nginxconfig.io/letsencrypt.conf;
location / {
rewrite ^ https://$host$request_uri? permanent;
}
}
nginx/nginxconfig.io/letsencrypt.conf:
# ACME-challenge
location ^~ /.well-known/acme-challenge/ {
allow all;
root /var/www/html/example;
}
nginx/nginxconfig.io/general.conf:
# favicon.ico
location = /favicon.ico {
log_not_found off;
access_log off;
}
# robots.txt
location = /robots.txt {
log_not_found off;
access_log off;
}
# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
expires 1y;
access_log off;
}
# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
add_header Access-Control-Allow-Origin "*";
expires 1y;
access_log off;
}
# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
#this is somewhere else hence why its commented out
#gzip_types image/svg+xml text/plain text/html text/xml text/css text/javascript application/xml application/xhtml+xml application/rss+xml application/javascript application/x-javascript application/x-font-ttf application/vnd.ms-fontobject font/opentype font/ttf font/eot font/otf;
nginx/nginxconfig.io/security.conf:
# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
#add_header Content-Security-Policy "<INSERT YOUR HEADERS HERE>" always;
add_header Permissions-Policy "interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# . files
location ~ /\.(?!well-known) {
deny all;
}
nginx/nginxconfig.io/wordpress:
# restrict methods
if ($request_method !~ ^(GET|POST|HEAD|CONNECT)$) {
#return '405';
return '444';
}
# WordPress: deny wp-content, wp-includes php files
location ~* ^/(?:wp-content|wp-includes)/.*\.php$ {
deny all;
}
# WordPress: deny wp-content/uploads nasty stuff
location ~* ^/wp-content/uploads/.*\.(?:s?html?|php|js|swf)$ {
deny all;
}
# WordPress: deny wp-content/plugins (except earlier rules)
location ~ ^/wp-content/plugins {
deny all;
}
# WordPress: deny general stuff
location ~* ^/(?:xmlrpc\.php|wp-links-opml\.php|wp-config\.php|wp-config-sample\.php|readme\.html|license\.txt)$ {
deny all;
}
location ~ ^/\.user\.ini {
deny all;
}
location ~ /\.ht {
deny all;
}
#location = /wp-admin/install.php { deny all; }
location ~ /\.htaccess$ { deny all; }
location ~ /readme\.txt$ { deny all; }
#location ~ ^/wp-admin/includes/ { deny all; }
# Disable PHP in Uploads - Security > Settings > System Tweaks > PHP in Uploads
location ~* \.(xml|xsl)$ { add_header Cache-Control "no-cache, no-store, must-revalidate, max-age=0"; expires -1; }
location /robots.txt { add_header Cache-Control "no-cache, no-store, must-revalidate, max-age=0"; expires -1; }
location ~* \.(css|js|pdf)$ { add_header Cache-Control "public, must-revalidate, proxy-revalidate, immutable, max-age=2592000, stale-while-revalidate=86400, stale-if-error=604800"; expires 30d; }
location ~* \.(jpg|jpeg|png|gif|ico|eot|swf|svg|webp|avif|ttf|otf|woff|woff2|ogg|mp4|mpeg|avi|mkv|webm|mp3)$ { add_header Cache-Control "public, must-revalidate, proxy-revalidate, immutable, max-age=31536000, stale-while-revalidate=86400, stale-if-error=604800"; expires 365d; }
location /wp-cron.php { add_header Cache-Control "no-cache, no-store, must-revalidate, max-age=0"; expires -1; }
location = /wp-content/wp-cloudflare-super-page-cache/example.com/debug.log { access_log off; deny all; }
nginx/nginx.conf:
user nginx;
pid /var/run/nginx.pid;
worker_processes 4;
worker_rlimit_nofile 65535;
include /etc/nginx/modules-enabled/*.conf;
events {
multi_accept on;
worker_connections 65535;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
keepalive_timeout 65;
#gzip on;
charset utf-8;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
log_not_found off;
types_hash_max_size 2048;
types_hash_bucket_size 64;
client_max_body_size 256M;
# MIME
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Logging
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log warn;
# SSL
ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;
# Diffie-Hellman parameter for DHE ciphersuites
ssl_dhparam /etc/letsencrypt/certs/dhparam.pem;
ssl_prefer_server_ciphers off;
# Mozilla Intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
resolver_timeout 2s;
# Load configs
include /etc/nginx/conf.d/*.conf;
server_tokens off;
}
this is everything I have, I hope this helps anyone who has an idea of what could be wrong with it
