The Perfect Nginx Server - Ubuntu (24.04) Edition

In this lecture I'm going to introduce you to the essential Linux skills you need to complete this course successfully.

This is the new 2024 Linux Essential Skills mini - crash - course that I include with all my courses.

If you are new to Linux, it's very important that you take your time and work your way through this lecture. You must use this section to familiarize yourself with the commands and the various aspects of Linux in relation to this course. All of the topics are important, don't skip any of the topics in this lecture.

If you are familiar with Linux and have used the command line to before, then please feel free to skip this lecture.

This is the first Essential Skills Lecture

In this lecture I'm going to introduce you to the essential Linux skills you need to complete this course successfully.

This is the new 2024 Linux Essential Skills mini - crash - course that I include with all my courses.

If you are new to Linux, it's very important that you take your time and work your way through this lecture. You must use this section to familiarize yourself with the commands and the various aspects of Linux in relation to this course. All of the topics are important, don't skip any of the topics in this lecture.

If you are familiar with Linux and have used the command line to before, then please feel free to skip this lecture.

This is the second Essential Skills Lecture

In this lecture I'm going to introduce you to the essential Linux skills you need to complete this course successfully.

This is the new 2024 Linux Essential Skills mini - crash - course that I include with all my courses.

If you are new to Linux, it's very important that you take your time and work your way through this lecture. You must use this section to familiarize yourself with the commands and the various aspects of Linux in relation to this course. All of the topics are important, don't skip any of the topics in this lecture.

If you are familiar with Linux and have used the command line to before, then please feel free to skip this lecture.

This is the third Essential Skills Lecture

In this lecture I'm going to introduce you to the essential Linux skills you need to complete this course successfully.

This is the new 2024 Linux Essential Skills mini - crash - course that I include with all my courses.

If you are new to Linux, it's very important that you take your time and work your way through this lecture. You must use this section to familiarize yourself with the commands and the various aspects of Linux in relation to this course. All of the topics are important, don't skip any of the topics in this lecture.

If you are familiar with Linux and have used the command line to before, then please feel free to skip this lecture.

This is the fourth Essential Skills Lecture

In this lecture we are going to look at the software you require to complete the course successfully. All the software used in this course and this includes any WordPress themes or plugins is free and or open source. You will not be required to purchase any software.

In this section we look at web hosts, server specifications for different types of WordPress sites. We are also going to create a server instance for the course.

Server hardening begins by changing the root user's password, creating a new non-root user, granting it root privileges, and then disabling root login for improved security.  This is the first lecture of the initial hardening process.

Server hardening begins by changing the root user's password, creating a new non-root user, granting it root privileges, and then disabling root login for improved security.  This is the second lecture of the initial hardening process.

As the non-root user, the process continues by enabling SSH key authentication to replace password-based logins, simplifying access with an SSH config file. Regularly updating server packages ensures security patches are applied, while implementing firewall policies locks down unused ports and services. Finally, installing Fail2ban helps protect against brute-force attacks by monitoring and banning suspicious login attempts. This is the first lecture of the hardening process as the non-root user.

As the non-root user, the process continues by enabling SSH key authentication to replace password-based logins, simplifying access with an SSH config file. Regularly updating server packages ensures security patches are applied, while implementing firewall policies locks down unused ports and services. Finally, installing Fail2ban helps protect against brute-force attacks by monitoring and banning suspicious login attempts. This is the second lecture of the hardening process as the non-root user.

As the non-root user, the process continues by enabling SSH key authentication to replace password-based logins, simplifying access with an SSH config file. Regularly updating server packages ensures security patches are applied, while implementing firewall policies locks down unused ports and services. Finally, installing Fail2ban helps protect against brute-force attacks by monitoring and banning suspicious login attempts. This is the third lecture of the hardening process as the non-root user.

As the non-root user, the process continues by enabling SSH key authentication to replace password-based logins, simplifying access with an SSH config file. Regularly updating server packages ensures security patches are applied, while implementing firewall policies locks down unused ports and services. Finally, installing Fail2ban helps protect against brute-force attacks by monitoring and banning suspicious login attempts. This is the fourth lecture of the hardening process as the non-root user.

Advanced server hardening involves several key optimizations and security measures. First, set the server's timezone to your local time. To prevent crashes due to memory exhaustion, configure SWAP to use SSD space as virtual memory. Secure the shared memory space to prevent exploitation and disable IPv6 by modifying the grub configuration. Harden and optimize the TCP/IP stack, and switch congestion control to BBR (Bottleneck Bandwidth and Round-trip Time) to boost throughput and reduce latency. For performance improvements, disable filesystem tracking of file access times and increase the maximum number of open files per process to allow for more concurrent connections. This is the first lecture of the section dealing with hardening and optimizing the server distro.

Advanced server hardening involves several key optimizations and security measures. First, set the server's timezone to your local time. To prevent crashes due to memory exhaustion, configure SWAP to use SSD space as virtual memory. Secure the shared memory space to prevent exploitation and disable IPv6 by modifying the grub configuration. Harden and optimize the TCP/IP stack, and switch congestion control to BBR (Bottleneck Bandwidth and Round-trip Time) to boost throughput and reduce latency. For performance improvements, disable filesystem tracking of file access times and increase the maximum number of open files per process to allow for more concurrent connections. This is the second lecture of the section dealing with hardening and optimizing the server distro.

Advanced server hardening involves several key optimizations and security measures. First, set the server's timezone to your local time. To prevent crashes due to memory exhaustion, configure SWAP to use SSD space as virtual memory. Secure the shared memory space to prevent exploitation and disable IPv6 by modifying the grub configuration. Harden and optimize the TCP/IP stack, and switch congestion control to BBR (Bottleneck Bandwidth and Round-trip Time) to boost throughput and reduce latency. For performance improvements, disable filesystem tracking of file access times and increase the maximum number of open files per process to allow for more concurrent connections. This is the third lecture of the section dealing with hardening and optimizing the server distro.

In this section we are going to look at how you point a domain name to your server using Cloudflare.

In this section of the course, we are going to look at official and unofficial repositories, the package manager and we are going to install the hosting stack. The hosting stack consists of nginx, MariaDB and php 8.3.

Nginx is the web server, MariaDB the database management system and php is the server-side scripting language that is responsible for generating the dynamic WordPress page content.

In this section we are going to configure the server to send mail using php. This will enable a SMTP service on your WP site and allow your sites to send mail without using any plugins.

We are also going to look at the easiest method to create a mail@your_domain email account.

Before we start configuring nginx, we need to look at the layout of a nginx configuration file as well as definitions that relate to nginx. This section is important as it teaches you how to read and understand a nginx configuration file.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the first of three lectures covering nginx.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the second of three lectures covering nginx.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the last lecture covering nginx.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the first of three lectures covering MariaDB.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the second of three lectures covering MariaDB.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the last lecture covering MariaDB.

We've installed the hosting stack, now we need to harden and optimize the stack. This is essential to protect against security vulnerabilities, improve performance, and ensure the stability and reliability of your server under varying workloads. Each component of the hosting stack will be hardened and optimized.

The is the first of two lectures covering PHP.

In this section we are going to look at file and directory administration. We are going to create the directories that are going to store our WP files and directories.

You can use the term server context or server block.

Nginx Server Blocks allow you to host and serve more than one site on your server. Some of the configuration that is included in a server block:

• port nginx must listen on 80 or 443

• domain name

• site root - where the files are located

• the index page nginx must serve

If you have used Apache before, the server context or server block is the equivalent of a virtual host. For each site you intend to host, you need to create a server block for that site.

This is the first of two lectures in this section

You can use the term server context or server block.

Nginx Server Blocks allow you to host and serve more than one site on your server. Some of the configuration that is included in a server block:

• port nginx must listen on 80 or 443

• domain name

• site root - where the files are located

• the index page nginx must serve

If you have used Apache before, the server context or server block is the equivalent of a virtual host. For each site you intend to host, you need to create a server block for that site.

This is the last lecture in this section

In this section, we are going to installing WordPress. This is part one of the correct procedure to install WordPress on a VPS or dedicated server.

In this section, we are going to installing WordPress. This is part two of the correct procedure to install WordPress on a VPS or dedicated server.

Hardening a WordPress site is crucial for enhancing its security and protecting it from various cyber threats. WordPress, being one of the most popular content management systems, is often targeted by hackers due to its widespread use.

Hardening your WordPress site is an essential step in maintaining its security and integrity, safeguarding both your data and the experience of your users.

By separating sites using PHP pools ensures better resource management and isolation, minimizing the impact of potential vulnerabilities.

Ownership and permissions must be set correctly, especially when using php pools, to prevent ownership and permissions from effecting site functionality.

We'll also lock the site down using open_basedir. This sets the access levels of files and directories, to help reduce the risk of unauthorized access and malicious activities.

We are going to install free ssl certificates and serve our sites over https only. The certificates will be rated A+.

The WP CRON system is used to schedule tasks to run at intervals on your WordPress site. Some examples are scheduling when you want a post to be published, checking for updates, or running a backup plugin at a specific time.

Unfortunately, as your site traffic increases so does the resource demands that WP CRON makes on your server. It will eventually start to slow down your server.

Running a cron from the server-side is so much more efficient than WP CRON as the server doesn’t need to involve PHP, the server will execute the CRON with minimal remands for resources.

We are going to harden the HTTP response headers. This is a security practice aimed at reducing the risk of certain types of attacks and improving overall server security.

We are going to make use of Nginx directives to further harden our WordPress site.

We'll look at the practice of using NGINX to protect a site against DDoS attacks and why it's not recommended for WP sites.

Implement rate limiting to prevent brute force attacks and protect server resources.

We'll look at Ninja Firewall, to provide an additional layer of security.

We'll also implement hotlinking protection of your site's assets by configuring Cloudflare and we'll also look at using NGINX to block requests from unauthorized referrers.

We are going to look at the WP constant DISALLOW_FILE_EDIT. This prevents attackers who gain access to WordPress admin from modifying files via the dashboard

We are going to harden the site database privileges and the WP Rest APU.  Implementing these measures can significantly enhance the security of your WordPress installation running on NGINX, protecting it against various common threats and vulnerabilities.

Caching is the process of storing frequently-accessed data temporarily in a cache so it can be reused for subsequent requests. The cache can be stored on disk or RAM, although RAM is best as it's much faster than a SSD drive.

So how does this relate to WP?

Optimizing WordPress involves addressing both server-side and application-side configurations that will significantly boost your WordPress site's speed and reliability. The most important step in optimizing WP is caching.

If you don’t need WP post revisions, then it's recommended to disable revisions as this can be beneficial for a few reasons

If you are running a large and complex site with many plugins and to avoid memory errors and performance issues, you need to increase the amount of memory that WordPress can use on the server. To accomplish this you need to set the php memory limit and the WP memory limit.

The types of caching we are going to look at in the course are as follows: page, object, opcode and browser caching.

A static WordPress site is a type of website where the content remains largely unchanged over time and is primarily informational. Such sites are typically used for presenting fixed content, such as company information, service descriptions, or portfolio displays.

A dynamic WordPress site is a type of website where content is frequently updated and often includes interactive features.

These sites are well-suited for applications where content changes regularly, such as blogs with active comment sections, news sites, e-commerce platforms, and forums.

Implementing caching in WordPress depends significantly on whether the site is static or dynamic, as each type benefits from different caching strategies.

FastCGI Caching

Configure Nginx to use FastCGI caching for serving cached pages directly from the server, bypassing PHP for maximum efficiency.

WP Super Cache:

Use this plugin to generate static HTML files and serve them directly, minimizing server load and speeding up page delivery.

W3 Total Cache (W3TC):

Utilize this comprehensive plugin for page caching, browser caching, and also CDN integration to optimize static content delivery.

To make use of Redis for object caching, you first need to install and configure Redis on your server.

Once Redis is installed and configured, it can be used by any site on your server. However, sites don't automatically use Redis; you must install and enable a Redis plugin for each site that you want to benefit from object caching.

Caching a dynamic site effectively involves a combination of page and object caching strategies to balance performance optimization with maintaining dynamic functionality.

When caching a dynamic site, it's crucial to choose the right caching strategy to balance performance and functionality.

WP Super Cache, can be combined with object caching to improve site speed and responsiveness while maintaining dynamic content accuracy.

When caching a dynamic site, it's crucial to choose the right caching strategy to balance performance and functionality.

W3TC offers advanced caching options and built-in support for object caching, making it an excellent choice for managing both page caching and object caching in one solution.

Configuring PHP-FPM to handle incoming PHP requests effectively, it is crucial to specify the maximum number of child processes that PHP-FPM can spawn.

I encourage you to sign up for the free CF plan, it offers many advantages.

CF provides features such as a Content Delivery Network (CDN), which helps speed up website load times by distributing content across global data centers, ensuring faster access for users regardless of their location. Additionally, it includes basic DDoS protection to safeguard against malicious traffic and attacks, as well as SSL/TLS encryption for secure connections. The free plan also grants access to Cloudflare’s analytics, offering insights into website traffic and threats. These features collectively improve user experience, security, and website performance at no cost.

Regular server updates are important for maintaining the security, stability, and performance of your server. These updates encompass a variety of tasks, including installing security patches to safeguard against threats, fixing bugs to enhance reliability, and optimizing performance through software upgrades and removal of obsolete components.

WordPress updates, whether they involve the core, themes, or plugins, can sometimes lead to unexpected issues such as conflicts between different components or compatibility issues with other plugins or themes.

Having a backup in place provides you with a safety net. If an update causes any problems, you can quickly restore your site to its previous state and then investigate the issue further without causing prolonged downtime or potential data loss

In this lecture we look at WordPress backups. WordPress site migration and the WordPress Command Line Interface.

We are going to install ClamAV and Rkhunter.

ClamAV is a free and open-source antivirus engine to detect malware, viruses, and other malicious programs and software on your system.

A rootkit is a set of software tools that enable an unauthorized user to gain control of a computer system without being detected.

Rkhunter is a free a tool that is used to scan for backdoors, rootkits, and other vulnerabilities.

What we are going to cover in this section, is optimizing MariaDB, the Database Management System, so it can function more efficiently and offer higher performance.

Setting the correct pm.max_children directive correctly is important as setting it too low or too high can have a huge impact on your server's performance.

It's important to monitor the uptime of your sites.

Administering disk space on an Ubuntu server is an important task, as you server can crash is you run out of space.

The process involves several tasks, including monitoring disk usage and then cleaning up unnecessary files

The "default" nginx server block acts as a fallback for any incoming requests that don't match a more specific server block configuration. This ensures that even if a request doesn't target a specific website hosted on the server, Nginx will still serve some content, this is not a good security practice,

The "backlog" in the context of Nginx refers to the maximum length of the queue of pending connections waiting to be accepted by Nginx.

The opcache.max_accelerated_files defines the maximum number of PHP scripts files that OPcache can store in its internal hash table.

This setting directly impacts the number of scripts that can be cached for faster retrieval and therefore improving PHP application performance.

I'm not in favour of installing PMA on a server. I much prefer to use a desktop client and login to the server using a ssh tunnel.

Unfortunately, students prefer to use PMA, so they install and configure PMA using various online guides. These guides normally cover only the installation and not the hardening of PMA once installed. This can create a huge security risk on the server.

For this reason, I decided to include PMA installation, configuration and hardening in the course.

FileZilla is a free cross platform sftp client that can be used to upload and download files to and from your server.

A CSP dictates which resources (scripts, stylesheets, images, etc.) a web browser is allowed to load from specific domains. This restricts the execution of untrusted code, enhancing website security.

Implementing a CSP provides an additional layer of security that is extremely beneficial to a site.

Unfortunately, a CSP for a WP site will break your site unless the unsafe-inline and unsafe-eval directives are enabled. Enabling the directives unsafe-inline, unsafe-eval and allowing embedded data in a WordPress CSP policy is extremely dangerous