Web Servers: Apache and nginx

nginx/1.29.8 apache=false nginx=true got_mod_rewrite=false got_url_rewrite=true is_ssl=true
Apache/2.4.69 (Debian) apache=true nginx=false got_mod_rewrite=true got_url_rewrite=true is_ssl=true

sudo a2dismod php8.4 mpm_prefork
sudo a2enmod mpm_event proxy_fcgi rewrite headers expires ssl http2
sudo a2ensite lumenpress
sudo apachectl -t && sudo systemctl reload apache2

# /etc/apache2/sites-available/lumenpress.conf
<VirtualHost *:80>
    ServerName lumenpress.example
    ServerAlias www.lumenpress.example
    Redirect permanent / https://lumenpress.example/
</VirtualHost>

<VirtualHost *:443>
    ServerName lumenpress.example
    DocumentRoot /var/www/lumen

    Protocols h2 http/1.1

    SSLEngine on
    SSLCertificateFile    /etc/ssl/lumenpress/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/lumenpress/privkey.pem
    SSLProtocol           -all +TLSv1.2 +TLSv1.3
    Header always set Strict-Transport-Security "max-age=31536000"

    <Directory /var/www/lumen>
        Options FollowSymLinks
        # FileInfo: mod_rewrite. AuthConfig: Require and Auth*. Indexes: mod_expires. Options=Indexes: "Options -Indexes".
        AllowOverride AuthConfig FileInfo Indexes Options=Indexes
        Require all granted
        # Pass the Authorization header to PHP (application passwords, REST API).
        CGIPassAuth On
    </Directory>

    # Hand .php files that exist to the site's PHP-FPM pool.
    <FilesMatch "\.php$">
        <If "-f %{REQUEST_FILENAME}">
            SetHandler "proxy:unix:/run/php/lumen.sock|fcgi://localhost/"
        </If>
    </FilesMatch>
    DirectoryIndex index.php

    ErrorLog  ${APACHE_LOG_DIR}/lumenpress-error.log
    CustomLog ${APACHE_LOG_DIR}/lumenpress-access.log combined
</VirtualHost>

# /var/www/lumen/.htaccess - Lumen Press, Apache 2.4

# Deny configuration, logs and dot files.
<FilesMatch "^(wp-config\.php|debug\.log|readme\.html|license\.txt|\.ht.*|\.user\.ini)$">
    Require all denied
</FilesMatch>

# XML-RPC is not used by Lumen Press.
<Files "xmlrpc.php">
    Require all denied
</Files>

# The login screen: office network, or HTTP Basic credentials.
<Files "wp-login.php">
    AuthType Basic
    AuthName "Lumen Press staff"
    AuthUserFile /etc/apache2/lumenpress.htpasswd
    <RequireAny>
        Require ip 203.0.113.0/24
        Require valid-user
    </RequireAny>
</Files>

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# Long-lived caching for static assets; HTML is not cached by the browser.
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css                 "access plus 1 year"
    ExpiresByType text/javascript          "access plus 1 year"
    ExpiresByType image/webp               "access plus 1 year"
    ExpiresByType image/jpeg               "access plus 1 year"
    ExpiresByType font/woff2               "access plus 1 year"
</IfModule>

Options -Indexes

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# /var/www/lumen/wp-content/uploads/.htaccess
<FilesMatch "\.(php|phar|phtml|php\d)$">
    Require all denied
</FilesMatch>

# mod_access_compat loaded, but AllowOverride does not include Limit:
/var/www/lumen/old/.htaccess: order not allowed here
# mod_access_compat not loaded:
/var/www/lumen/old/.htaccess: Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration

# /var/www/lumen/.htaccess - core files live in /var/www/lumen/wp
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} ^(www\.)?lumenpress\.example$
RewriteCond %{REQUEST_URI} !^/wp/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /wp/$1
RewriteCond %{HTTP_HOST} ^(www\.)?lumenpress\.example$
RewriteRule ^(/)?$ wp/index.php [L]
</IfModule>

# /etc/nginx/conf.d/lumenpress.conf (included inside the http { } block)

upstream lumen_php {
    server unix:/run/php/lumen.sock;
}

# 10 requests per minute per client address for the login form.
limit_req_zone $binary_remote_addr zone=lumen_login:10m rate=10r/m;

server {
    listen 80;
    listen [::]:80;
    server_name lumenpress.example www.lumenpress.example;
    return 301 https://lumenpress.example$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;
    http2 on;
    http3 on;
    server_name lumenpress.example;

    ssl_certificate     /etc/ssl/lumenpress/fullchain.pem;
    ssl_certificate_key /etc/ssl/lumenpress/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:lumen_tls:10m;
    ssl_session_timeout 1d;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    add_header Strict-Transport-Security "max-age=31536000" always;

    root /var/www/lumen;
    index index.php;
    client_max_body_size 72m;

    include snippets/wordpress-restrictions.conf;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location = /wp-login.php {
        limit_req zone=lumen_login burst=5 nodelay;
        limit_req_status 429;
        include snippets/wordpress-php.conf;
    }

    location ~ \.php$ {
        include snippets/wordpress-php.conf;
    }

    location ~* \.(?:css|js|mjs|avif|webp|jpe?g|png|gif|ico|svg|woff2?)$ {
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        add_header Strict-Transport-Security "max-age=31536000" always;
        access_log off;
        log_not_found off;
        try_files $uri =404;
    }
}

# /etc/nginx/snippets/wordpress-php.conf
# Refuse scripts that do not exist instead of passing them to PHP.
try_files $uri =404;
fastcgi_split_path_info ^(.+?\.php)(/.*)$;

include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO       $fastcgi_path_info;
fastcgi_index index.php;

fastcgi_read_timeout 120s;
fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;
fastcgi_pass lumen_php;

# /etc/nginx/snippets/wordpress-restrictions.conf
location = /favicon.ico { log_not_found off; access_log off; }
location = /robots.txt  { log_not_found off; access_log off; try_files $uri /index.php?$args; }

# Dot files (.htaccess, .git, .user.ini), except the ACME challenge directory.
location ~ /\.(?!well-known/) { deny all; }

# Configuration, logs and core files that need not be public.
location ~* ^/(?:wp-config\.php|wp-config-sample\.php|readme\.html|license\.txt)$ { deny all; }
location ~* ^/wp-content/debug\.log$ { deny all; }

# XML-RPC is not used by Lumen Press.
location = /xmlrpc.php { deny all; access_log off; }

# Never execute PHP from uploads.
location ~* ^/wp-content/uploads/.*\.(?:php\d*|phtml|phar)$ { deny all; }

# Include-only core files.
location ~ ^/wp-admin/includes/ { deny all; }
location ~ ^/wp-includes/[^/]+\.php$ { deny all; }
location ~ ^/wp-includes/theme-compat/ { deny all; }

$ nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ for i in 1 2 3 4 5 6 7 8; do curl -s -o /dev/null -w '%{http_code} ' https://lumenpress.example/wp-login.php; done
200 200 200 200 200 200 429 429

$ curl -s --http3-only -o /dev/null -w '%{http_code} HTTP/%{http_version}\n' https://lumenpress.example/about/
200 HTTP/3

# /etc/nginx/snippets/wordpress-multisite-subdir.conf
# Sub-directory network: /kids/wp-admin/ and /noir/wp-login.php are served by the core files in the root.
if (!-e $request_filename) {
    rewrite /wp-admin$ $scheme://$host$request_uri/ permanent;
    rewrite ^(/[^/]+)?(/wp-.*) $2 last;
    rewrite ^(/[^/]+)?(/.*\.php) $2 last;
}

server {
    # listen, server_name and TLS as above
    root /var/www/lumen;
    index index.php;

    location / {
        try_files $uri /wp$uri /wp$uri/ /wp/index.php?$args;
    }

    location ~ \.php$ {
        try_files $uri /wp$uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass lumen_php;
    }
}