Secure WordPress and PrestaShop with free Let’s Encrypt SSL certificates. This Nginx configuration enables ACME challenges, blocks hidden files, and serves static assets directly for better performance and security.

Walkthrough

Favicon and robots.txt

# URL that contains "favicon"
location ~ favicon {
	log_not_found off;
	access_log off;
}
# URL equals to "/robots.txt"
location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
}

Allow Let’s Encrypt ACME Challenge

# Allow Let's Encrypt (URL starting with "/.well-known/acme-challenge")
location ~ ^/.well-known/acme-challenge {
	allow all;
}

Deny all dot files (.htaccess, .htpasswd, …)

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
	deny all;
	access_log off;
	log_not_found off;
}

Serve raw files directly with Nginx

Don’t use Nginx then Apache for static files, serve them directly

for PrestaShop

location ~ ^(/assets/|/img/|/dist/|/base/|/vendor/.+/Resources/public/) {
	try_files $uri 404;
}

For WordPress

location /wp-content {
	try_files $uri 404;
}
location /wp-includes {
	try_files $uri 404;
}

Going further