Multiplexed connections — requires SSL

UDP-based transport — requires QUIC-enabled nginx build

30-day nginx cache for images, CSS, JS, fonts — served without touching backend

Optimised buffering & 20-min timeout for mp4, webm, ogg, mov — Range request support

Adds /_next/ location — disables WAF for static chunks & HMR

Adds a dedicated location block with Upgrade: websocket headers (Socket.io, Laravel Echo, SSH terminals…)

Serve WafX-themed 4xx/5xx pages (403, 404, 429, 500, 502, 503, 504)

Bypasses Coraza entirely at server level — use for SSH terminals, binary WebSockets, or apps with persistent false positives

Block known scrapers and bad bots by user-agent

Limit concurrent connections per IP (max 30)

Restrict requests per minute per IP

Force HTTPS for all future visits via browser cache

CSP, X-Frame-Options, CORP, COOP, Referrer-Policy, Permissions-Policy

Apply WordPress hardening rules in nginx for this host

Deny /xmlrpc.php — exploited for DDoS & brute-force

Block /?author=N — prevents username harvesting

Deny WPScan, sqlmap, nikto, nmap, masscan, nuclei…

Block PHP execution in wp-content/uploads/

Deny wp-config.php, .env, .htaccess, .git

Strip X-Powered-By and ?ver= query strings

Limit /wp-login.php requests per IP per minute

Generate a hardened proxy_pass location / block in nginx

X-Real-IP & X-Forwarded-For — required for effective rate-limiting

X-Forwarded-Proto — prevents redirect loop & missing Secure cookie

proxy_set_header Host $host — prevents Host Header Injection

Strip Server, X-Powered-By, X-Generator, X-WP-Nonce

Return 405 — prevents Cross-Site Tracing (XST)

Improve performance — disable for SSE / streaming backends

Serve PHP/Laravel directly via PHP-FPM instead of a reverse proxy