server {
        listen 80;
        listen [::]:80;
        listen 443 ssl;
        listen [::]:443 ssl;

        server_name stm.mitrofanov.ru;

        more_set_headers 'Strict-Transport-Security : max-age=31536000; includeSubDomains; preload';

        return 301 https://stmholding.ru$request_uri;
    }

    server {
        listen 443 ssl;
        listen [::]:443 ssl;

        server_name www.stmholding.ru;

        more_set_headers 'Strict-Transport-Security : max-age=31536000; includeSubDomains; preload';

        return 301 https://stmholding.ru$request_uri;
    }


server {

    server_name stmholding.ru;

    listen 443 ssl;
    listen [::]:443 ssl;

    root /www/html/stm/wordpress;

ssl_certificate /etc/letsencrypt/live/stmholding.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stmholding.ru/privkey.pem;

    index index.php index.html;

    # Безопасность
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

location @empty {
empty_gif;
access_log off;
}

location = /favicon.ico {
add_header Cache-Control private;
expires max;
try_files /favicon.ico @empty;
}

    # Кеширование статики
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|webp|woff|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
        try_files $uri =404;
    }

    # Правильные правила для WordPress
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # Обработка PHP
    location ~ \.php$ {

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        fastcgi_split_path_info    ^(.+?\.php)(/.*)$;
        fastcgi_hide_header X-Powered-By;
        fastcgi_intercept_errors on;
        fastcgi_ignore_headers Cache-Control Expires;
        fastcgi_pass_header Set-Cookie;
        fastcgi_pass_header Cookie;
        fastcgi_index index.php;
        fastcgi_temp_file_write_size 256k;
        fastcgi_busy_buffers_size 256k;
        fastcgi_read_timeout 240;
        fastcgi_pass      unix:/run/php/php8.2-fpm.sock;
        include /etc/nginx/fastcgi_params;
        fastcgi_param HTTP_HOST $host;

        fastcgi_buffer_size 64k;
        fastcgi_buffers 8 64k;

    }

    # Защита системных файлов WordPress
    location ~* /wp-config.php { deny all; }
    location ~* /readme.html { deny all; }
    location ~* /license.txt { deny all; }

    # Блокировка доступа к .ht*
    location ~ /\.ht {
        deny all;
    }
}


#
# Redirect all www to non-www
#

    server {
        listen 80;
        listen [::]:80;
        server_name stmholding.ru www.stmholding.ru;
        return 301 https://stmholding.ru$request_uri;
    }