wordpress.conf

# /etc/nginx/sites-available/wordpress.conf

# Redirect everything to the main site. We use a separate server statement and NOT an if statement - see https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/
server {
    server_name  _;
    return 302 $scheme://example.com$request_uri;
}

server {
    #listen [::]:80; 
    listen 80;
    server_name example.com;
    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    #listen [::]:443 ssl http2; 
    listen 443 ssl http2;
    server_name example.com; 
    
    root /var/www/html/wordpress/; 
    index index.php;
    
    access_log /var/log/nginx/example.log;
    error_log /var/log/nginx/example.error.log;

    ## replace with your SSL certificate
    ssl_certificate /etc/letsencrypt/live/example.com.pem;
    ssl_certificate_key /etc/letsencrypt/live/.example.com.pem;
    
    # Enable HSTS. This forces SSL on clients that respect it, most modern browsers. The includeSubDomains flag is optional.
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

    # Set caches, protocols, and accepted ciphers. This config will merit an A+ SSL Labs score as of Sept 2015.
    ssl_session_cache shared:SSL:20m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';    

    add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the instance
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    include /etc/nginx/sites-available/wp-global-restrictions.conf;
    include /etc/nginx/sites-available/wp-general.conf;

}