Wordpress woocommerce issue and question about whitelisting

I installed wordpress manually by creating a mysql database and username and password via command line, then via winSCP I uploaded my wordpress files, imported backup through a wordpress plugin.

---

However, I installed wordpress in a sub-directory, as on the main directory I have xenforo.
I executed:

Code:

chown -R nginx:nginx /home/nginx/domains/domain.com/public/wp/wp-content/plugins/

Code:

chown nginx:nginx /home/nginx/domains/domain.com/public/wp
chown -R nginx:nginx /home/nginx/domains/domain.com/public/wp

nginx vhost:
nano /usr/local/nginx/conf/conf.d/domain.com.conf

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html

# redirect from non-www to www
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
#server {
#            listen   80;
#            server_name domain.com;
#            return 301 $scheme://www.domain.com$request_uri;
#       }

server {

  server_name domain.com www.domain.com;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/domain.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/domain.com/log/error.log;

  include /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf;
  root /home/nginx/domains/domain.com/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  #include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  # prevent access to ./directories and files
  #location ~ (?:^|/)\. {
  # deny all;
  #}

  location / {
    try_files $uri $uri/ /index.php?$uri&$args;
    index index.php index.html index.htm;

  include /usr/local/nginx/conf/503include-only.conf;

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;

  # Enables directory listings when index file not found
  #autoindex  on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Wordpress Permalinks example
  #try_files $uri $uri/ /index.php?q=$uri&$args;

  }

  location /wp {
   try_files $uri $uri/ /wp/index.php?q=$request_uri;
     include /usr/local/nginx/conf/wpsecure.conf;
     include /usr/local/nginx/conf/wpnocache.conf;
  }

  location /internal_data/ {
  internal;
  allow 127.0.0.1;
  deny all;
  }

  location /library/ {
  internal;
  allow 127.0.0.1;
  deny all;
  }

  location /install/templates/ {
           internal;
  }

  location /install/data/ {
            internal;
 }

  location /wp {
   try_files $uri $uri/ /wp/index.php?q=$request_uri;
     include /usr/local/nginx/conf/wpsecure.conf;
     include /usr/local/nginx/conf/wpnocache.conf;
  }

  location /internal_data/ {
  internal;
  allow 127.0.0.1;
  deny all;
  }

  location /library/ {
  internal;
  allow 127.0.0.1;
  deny all;
  }

  location /install/templates/ {
           internal;
  }

  location /install/data/ {
            internal;

  }


  include /usr/local/nginx/conf/pre-staticfiles-local-domain.com.conf;
  include /usr/local/nginx/conf/pre-staticfiles-global.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;

  include /usr/local/nginx/conf/drop.conf;
  include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

nano /usr/local/nginx/conf/wpsecure.conf

Code:

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
location ~* /(?:uploads|files)/.*\.php$ {
        deny all;
}

# Whitelist Exception for https://wordpress.org/plugins/woocommerce/
location ~ ^/wp-content/plugins/woocommerce/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for gravityforms
location ~ ^/wp-content/plugins/gravityforms/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for gravityforms iframe master
location ~ ^/wp-content/plugins/gravity-forms-iframe-master/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for gravityforms custom post types
location ~ ^/wp-content/plugins/gravity-forms-custom-post-types/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for custom plugin
location ~ ^/wp-content/plugins/reuse_cartItems_after_checkout_for_diff_payment_methods/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for woocommerce-conditional-product-fees-for-checkout
location ~ ^/wp-content/plugins/woocommerce-conditional-product-fees-for-checkout/ {
  include /usr/local/nginx/conf/php.conf;
}

# Whitelist Exception for modular-custom-css
location ~ ^/wp-content/plugins/modular-custom-css/ {
  include /usr/local/nginx/conf/php.conf;
}

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
        return 444;
}

#nocgi
location ~* \.(pl|cgi|py|sh|lua)\$ {
        return 444;
}

#disallow
    location ~* (roundcube|webdav|smtp|http\:|soap|w00tw00t) {
        return 444;
}

location ~ /(\.|wp-config\.php|readme\.html|license\.txt) { deny all; }

Is my whitelisting of woocommerce right? or do I need to specify the subdirectory that wp is installed on, in this example and others:

Code:

# Whitelist Exception for https://wordpress.org/plugins/woocommerce/
location ~ ^/wp-content/plugins/woocommerce/ {
  include /usr/local/nginx/conf/php.conf;
}

The issue is that on woocommerce checkout page for a product, the spinning wheel on choosing payment option keeps spinning like not loading the full page.

 

Aside from the woocommerce checkout page loading correctly however PAYMENT options spinning indefinitely which might be related to cache? even though I haven't set up any cache plugins or options. I saw this thread, does it apply here with centmin mod?
Settings nginx + woocommerce



I really appreciate any input as my whole project is based on this concept of iframing that specific form from my wordpress directory to my xenforo custom page.

.

 

would it be like that?

Code:

# Whitelist Exception for https://wordpress.org/plugins/woocommerce/
location ~ ^wp/wp-content/plugins/woocommerce/ {
  include /usr/local/nginx/conf/php.conf;
}

I see it's at location /wp, I'll delete the duplicate.

 

thanks for the whitelisitng, in-regards to the duplicate I see it's at:

Code:

  location /install/templates/ {
           internal;
  }

  location /install/data/ {
            internal;

  }

 

What about these?

Code:

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
        return 444;
}

#nocgi
location ~* \.(pl|cgi|py|sh|lua)\$ {
        return 444;
}

#disallow
    location ~* (roundcube|webdav|smtp|http\:|soap|w00tw00t) {
        return 444;
}

location ~ /(\.|wp-config\.php|readme\.html|license\.txt) { deny all; }

Would it be:?

Code:

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \wp\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
        return 444;
}

#nocgi
location ~* \wp\.(pl|cgi|py|sh|lua)\$ {
        return 444;
}

#disallow
    location ~* (roundcube|webdav|smtp|http\:|soap|w00tw00t) {
        return 444;
}

location ~ /wp/(\.|wp-config\.php|readme\.html|license\.txt) { deny all; }

 

for iframe I figured out I need to add this:

Code:

Configuring nginx
To configure nginx to send the X-Frame-Options header, add this either to your http, server or location configuration:

add_header X-Frame-Options SAMEORIGIN;

Do I add it in

Code:

location / {
}

and

Code:

location /wp {
}

or just outside locations?

also, is location /wp -OR- location /wp/? trailing slash?

 

got this in my error log:

Code:

2018/02/09 20:30:04 [error] 23945#23945: *1121 connect() failed (111: Connection refused) while connecting to upstream, client: xx.xx.xx5.216, server: domain.com, request: "GET /wp/gfembed/?f=1 HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "domain.com"

And on access log

Code:

xx.xx.xx5.216 - - [09/Feb/2018:20:34:21 +0000] "GET /wp/gfembed/?f=1 HTTP/1.1" 500 2796 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0"

also woocommerce checkout page, payment options still spinning wheel indefinitely.

 

Yes I'm on
Centmin Mod Menu 123.09beta01 centminmod.com
and I don't have .htaccess in wordpress as far as I look into the directories of the wordpress installation and plugins using winSCP.

 

returns nothing, what should it be?

 

Got both of the issues fixed, through including X-Frame-Options and changing wordpress location to:

Code:

try_files $uri $uri/ /wp/index.php?$args;

I'm now on the process of implementing ssl
still @eva2000 what would you recommend for SSL, spdy or Nginx HTTP/2, I've seen that http/2 doesn't support android default browsers which might break user experience if the certificate isn't valid or something?