WordpressOctober 29, 2015

不用插件，把WordPress站点网络的分站绑定到一级域名

前一篇写了下怎么用站点网络功能，在一个Wordpress安装上建立多个分站，不过分站只能绑定到二级域名，这样意义就不大了。怎么绑定到一级域名呢？网上查了一下，要用一个Domain Mapping插件，可是这个插件貌似与新版Wordpress兼容性不大好。恰好找到这个帖子，不用插件也可以绑定！（可能需要先保证Pretty Permalink正常使用）具体说来这么几步：

nginxOctober 29, 2015

WordPress站点网络初步探索

WordPress 3.0+版本支持MultiSite，站点网络功能，也就是安装一份Wordpress，就可以弄出多个WP站点来，就像新浪博客那样。默认情况下可以支持sub-domain（二级域名）和sub-directory（子目录）两种方式。官方文档提供了Apache的配置方式，nginx的配置文档要在nginx官网找。试了一下sub-domain模式，非常简单。

PHPOctober 29, 2015

nginx下建立WordPress站点的小总结

1、PHP配置

disable_functions = show_source,phpinfo,passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,escapeshellcmd,dll,popen,disk_free_space,checkdnsrr,checkdnsrr,getservbyname,getservbyport,disk_total_space,posix_ctermid,posix_get_last_error,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid, posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid, posix_getppid,posix_getpwnam,posix_getpwuid, posix_getrlimit, posix_getsid,posix_getuid,posix_isatty, posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid, posix_setpgid,posix_setsid,posix_setuid,posix_strerror,posix_times,posix_ttyname,posix_uname,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority

disable_functions = show_source,phpinfo,passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,escapeshellcmd,dll,popen,disk_free_space,checkdnsrr,checkdnsrr,getservbyname,getservbyport,disk_total_space,posix_ctermid,posix_get_last_error,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid, posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid, posix_getppid,posix_getpwnam,posix_getpwuid, posix_getrlimit, posix_getsid,posix_getuid,posix_isatty, posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid, posix_setpgid,posix_setsid,posix_setuid,posix_strerror,posix_times,posix_ttyname,posix_uname,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority

nginxOctober 28, 2015

nginx上WordPress上传目录权限的解决方案

之前的配置文件总有这样那样的问题。经过反复测试，现在这样写：

location /wp-content/uploads/ {
    #只有jpg/jpeg/png/gif文件可以被访问，其它的一律403。
    if ($request_filename !~* \.(jpg|jpeg|gif|png)$) {
        return 403;
        }
    #只写上面一段的话，php还是会被解析运行，大概是优先级的问题，还得写下面这句才行
    location ~* .*.(php|cgi|sh|py|pl|jsp|asp)$ {
        deny all;
    }
}

location /wp-content/uploads/ {

#只有jpg/jpeg/png/gif文件可以被访问，其它的一律403。

if ($request_filename !~* \.(jpg|jpeg|gif|png)$) {

return 403;

}

#只写上面一段的话，php还是会被解析运行，大概是优先级的问题，还得写下面这句才行

location ~* .*.(php|cgi|sh|py|pl|jsp|asp)$ {

deny all;

}

这样一来，只有jpg/jpeg/png/gif文件可以被访问，其它的一律403。

nginxOctober 28, 2015

参照nginx官方样本重新配置WordPress站点

nginx官网提供了常用blog/cms等系统的示例配置文件。Wordpress的在这里。基础的是这样：

server {
        ## Your website name goes here.
        server_name domain.tld;
        ## Your only path reference.
        root /var/www/wordpress;
        ## This should be in your http block and if it is, it's not needed here.
        index index.php;

        location = /favicon.ico {
                log_not_found off;
                access_log off;
        }

        location = /robots.txt {
                allow all;
                log_not_found off;
                access_log off;
        }

        location / {
                # This is cool because no php is touched for static content.
                # include the "?$args" part so non-default permalinks doesn't break when using query string
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
                include fastcgi.conf;
                fastcgi_intercept_errors on;
                fastcgi_pass php;
        }

        location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
                expires max;
                log_not_found off;
        }
}

server {

## Your website name goes here.

server_name domain.tld;

## Your only path reference.

root /var/www/wordpress;

## This should be in your http block and if it is, it's not needed here.

index index.php;

location = /favicon.ico {

log_not_found off;

access_log off;

}

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

location / {

# This is cool because no php is touched for static content.

# include the "?$args" part so non-default permalinks doesn't break when using query string

try_files $uri $uri/ /index.php?$args;

}

location ~ \.php$ {

#NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

include fastcgi.conf;

fastcgi_intercept_errors on;

fastcgi_pass php;

}

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {

expires max;

log_not_found off;

}

后面还有一些多站共存之类的配置。按照这个范本我对我自己的配置做了一些调整，试了一下完全可行，比原来的好用。看来之前对nginx的配置还是不够了解。我自己的配置大致是这样：

#禁止空主机头访问
server {
    listen       80 default_server;
    server_name _;
    return 500;
}

server {
    listen       80;
    server_name  youdomain.com www.yourdomain.com;
    #下面这条规定站点根目录，再往下的配置就以此为根
    root /usr/share/nginx/siterootpath;
    index index.php;

    #charset koi8-r;
    #下面这句是访问log，按需开关
    #access_log  /var/log/nginx/log/host.access.log  main;

    #favicon，站点的图标，可以显示在浏览器标题栏上，和robots.txt两个都不需要log
    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location =/robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
    # 所有静态文件都直通，解决了之前jpg等文件单独设置直通的问题，另外还可以直接支持固定链接
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
    
    #自定义404
    #error_page  404              /404.html;

    #自定义错误页
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    #对上传目录禁止执行php，并阻止除图片以外的任何文件类型
    location /wp-content/uploads/ {
        if ($request_filename !~* \.(jpg|jpeg|gif|png)$) {
             return 403;
        }
        location ~ .*\.(php)?$ {
           deny all;
        }
    }
    # php文件发送到php5-fpm，现在这一段不需要写root目录了
    #
    location ~ \.php$ {
        #检查php文件是否真实存在，防止伪装成jpg的php等
        if (!-f $document_root$fastcgi_script_name) {
            return 404;
        }
        fastcgi_pass   unix:/var/run/php5-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
    #js css 图片等文件最大化有效期，不记录访问
    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
    }
}

#禁止空主机头访问

server {

listen 80 default_server;

server_name _;

return 500;

}

server {

listen 80;

server_name youdomain.com www.yourdomain.com;

#下面这条规定站点根目录，再往下的配置就以此为根

root /usr/share/nginx/siterootpath;

index index.php;

#charset koi8-r;

#下面这句是访问log，按需开关

#access_log /var/log/nginx/log/host.access.log main;

#favicon，站点的图标，可以显示在浏览器标题栏上，和robots.txt两个都不需要log

location = /favicon.ico {

log_not_found off;

access_log off;

}

location =/robots.txt {

allow all;

log_not_found off;

access_log off;

}

# 所有静态文件都直通，解决了之前jpg等文件单独设置直通的问题，另外还可以直接支持固定链接

location / {

try_files $uri $uri/ /index.php?$args;

}

#自定义404

#error_page 404 /404.html;

#自定义错误页

# redirect server error pages to the static page /50x.html

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root /usr/share/nginx/html;

}

#对上传目录禁止执行php，并阻止除图片以外的任何文件类型

location /wp-content/uploads/ {

if ($request_filename !~* \.(jpg|jpeg|gif|png)$) {

return 403;

}

location ~ .*\.(php)?$ {

deny all;

}

# php文件发送到php5-fpm，现在这一段不需要写root目录了

location ~ \.php$ {

#检查php文件是否真实存在，防止伪装成jpg的php等

if (!-f $document_root$fastcgi_script_name) {

return 404;

}

fastcgi_pass unix:/var/run/php5-fpm.sock;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

include fastcgi_params;

}

# deny access to .htaccess files, if Apache's document root

# concurs with nginx's one

location ~ /\.ht {

deny all;

}

#js css 图片等文件最大化有效期，不记录访问

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {

expires max;

log_not_found off;

}