WordPress - MCP OAuth discovery documents

Hi @eva2000

Does your wpsecure.conf file need adjustments for the new Wordpress 7.1 version?

From Wordpress Site Heath Report /wp-admin/site-health.php

---

 

You're right.

It looks like WP Rocket adds the site health report.

 

Doesn't look like it changed anything. The report is still listed.

 

I had already ran nprestart and even cleared wp rocket cache, but no change unfortunately

 

Already did that but nothing changed.

 

Same contents. From the last updated timestamp (2024), no updates were made recently.

Code (Text):

# prepare for letsencrypt 
# https://community.centminmod.com/posts/17774/
location ~ /.well-known { location ~ /.well-known/acme-challenge/(.*) { more_set_headers    "Content-Type: text/plain"; } }

# allow AJAX requests in themes and plugins
location ~ ^/wp-admin/admin-ajax.php$ { allow all; include /usr/local/nginx/conf/php.conf; }

location ~* ^/(wp-content)/(.*?)\.(zip|gz|tar|bzip2|7z)$ { deny all; }

location ~ ^/wp-content/uploads/sucuri { deny all; }

location ~ ^/wp-content/updraft { deny all; }

# Block nginx-help log from public viewing
location ~* /wp-content/uploads/nginx-helper/ { deny all; }

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
location ~* /(?:uploads|files)/.*\.php$ {
        deny all;
}

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
        return 444;
}

#nocgi
location ~* \.(pl|cgi|py|sh|lua)$ {
        return 444;
}

#disallow
    location ~* (roundcube|webdav|smtp|http\:|soap|w00tw00t) {
        return 444;
}

location ~ /(\.|wp-config\.php|readme\.html|license\.txt) { deny all; }

Yes but I have a Wordpress site on another server that isn't using the orange proxy and it still reports it.

 

It causes nginx not to start until I remove it and restart.

I don't think I modified wpsecure. But I usually manually create the file with a copy/paste of the latest wpsecure contents from the vhost generator file.

 

Result

Code (Text):

nginx -t
nginx: [emerg] location "/.well-known/oauth-protected-resource" is outside location "/wp/" in /usr/local/nginx/conf/wpsecure.conf:43
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

I forgot I had a test wordpress site on another domain on the same server:

Code (Text):

  location /wp/ {
  try_files $uri $uri/ /wp/index.php?$uri&$args;
  index index.php index.html;

  include /usr/local/nginx/conf/wpsecure.conf;
  include /usr/local/nginx/conf/wpnocache.conf;

     include /usr/local/nginx/conf/php.conf;
     auth_basic "Private";
     auth_basic_user_file /usr/local/nginx/conf/htpasswd_testsetup;
  }