Third-Party Software Notice
Our support team cannot provide support for third-party software and services. However, if you need assistance or spot an issue with this article please post in the vCanopy Community Forum, and we will make necessary updates/improvements where needed.
iThemes Security is a great free security plugin, and has probably the most generous paid version.
A few features of this plugin – mostly the security hardening measures – require writing to a nginx configuration file.
You’ll be able to spot when these settings are activated as iThemes displays a message that says:
“The settings saved successfully.
You must restart your NGINX server for the changes to take effect.”
By default iThemes will create this file and add it to your website’s htdocs folder, however, this is both in the wrong place and it has the wrong name for the changes to take effect, even once Nginx has been reloaded.
ITHEMES SECURITY HARDENING AND vCanopy
Many of the features that iThemes offers are great for your average budget hosting provider, but with vCanopy, the following security hardening features are ready to go out of the box:
- Disable Directory Browsing
- Disable PHP execution in the uploads directory
- Disable PHP execution in the themes directory
And, the following are preventable by either one of our integrated Web Application Firewalls (WAFs):
- Filter Request Methods – Filter out hits with the trace or track request methods
- Filter Suspicious Query Strings in the URL
Learn more about our WAF integrations here:
There are also lots of extra, cool features you enable on your vCanopy servers via GP-CLI. See the following 2 articles on Fail2Ban integration and Nginx hardening here:
ACTIVATE YOUR ITHEMES SETTINGS
In this article we’ll look at how to change the filepath and name inside of iThemes so that the plugin can write your Nginx configurations to the correct file.
It’s important to note here that if you make any future changes in your iThemes settings, then you will need to SSH into your server, check your syntax is all correct, and then reload Nginx – quick and easy and detailed in step 3.
Step 1. SSH into your server:
Please see the following articles to get started:
Generate SSH Key on Windows with Putty
Generate SSH Key on Windows with Windows Subsystem for Linux
Generate SSH Key on Windows with Windows CMD/PowerShell
Add your SSH Key to vCanopy:
Add/Remove an SSH Key to/from an Active vCanopy Server
Connect to your server:
Step 2. Change the Nginx Configuration Name and Location
The config that iThemes creates and writes to by default gets placed inside your htdocs folder. This is the root directory of your website and we don’t run nginx config files from there.
We have a directory above root where we store local site nginx configs, and in our main nginx config there is a wildcard include: *-main-context.conf
Anything that matches this in the /var/www/site.url/nginx/*-main-context.conf will be included into nginx when it reloads. For the autogenerated iThemes config to work, we need to set the correct filepath and name inside iThemes’ Global settings (dashboard > iThemes > Settings):
CHANGE THE FILEPATH AND NAME
Open up the Global Settings options by clicking the Configure Settings button. The setting we need to change is called “NGINX Conf File” and it’s located a few setting up from the bottom:
Change this path to the following (switching out site.url for your domain name):
/var/www/site.url/nginx/ithemes-main-context.conf
For example:
/var/www/yourwebsite.com/nginx/ithemes-main-context.conf
IGNORE THE ERROR MESSAGES
iThemes will try to tell you that it can’t write to this location, however, it’s a big lie and it writes just fine. We’ve tested this extensively.
The one caveat here is that in my own testing it behaved strangely if there was already an ithemes-main-context.conf on the server. So, if you followed our previous guide on iThemes, you may need to remove this and then retry saving the settings again inside your website.
You can remove this by connecting to your server and running the following command (replacing site.url with your domain name):
rm /var/www/site.url/nginx/ithemes-main-context.conf
CHECK YOUR WORK
You can test that iThemes is writing correctly by turning on an Nginx-required feature. I tested this by turning XML-RPC on and off inside of the “WordPress Tweaks” settings.
You can check this has been written by viewing your configuration file with the following command (replacing site.url with your domain name):
cat /var/www/site.url/nginx/ithemes-main-context.conf
Usually this is located at the bottom of the file:
You can then enable XML-RPC and recheck your ithemes-main-context.conf again with the same command and you will see that this is now no longer there.
To step 3!
Step 3. Check and reload Nginx
We now need to test our Nginx syntax with:
nginx -t
If there are no errors present, reload Nginx with the following command:
gp ngx reload
Your iThemes settings have now been activated for your website.
Bonus Step
If you use the same settings for every website, you may wish to store a copy of these settings. You can also export your plugin settings inside of your WordPress dashboard. This way, next time your set up a website, you simply install the plugin, import your plugin settings, and then SSH into your server and head straight to step 3 below.
The export/import feature is located in Dashboard > iThemes Security > Settings > Notification Center. You’re looking for “Settings Export“.
You can check out how to do this with this KB from iThemes themselves:
https://help.ithemes.com/hc/en-us/articles/229241368-iThemes-Security-Settings-Import-and-Export