nginx.conf

# BEGIN Gzip Compression
gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

# Serve pre-compressed files
map $http_accept_encoding $gzip_suffix {
    "~gzip" ".gz";
    default "";
}

# Serve the correct content type for gzipped files
map $gzip_suffix $gzip_type {
    ".css.gz" "text/css";
    ".js.gz" "application/javascript";
    ".svg.gz" "image/svg+xml";
    default "";
}

# Apply gzip compression to matched files
server {
    ...
    location ~* \.(css|js)$ {
        add_header Content-Encoding gzip;
        try_files $uri$gzip_suffix $uri =404;
        types { $gzip_suffix $gzip_type; }
    }
    ...
}

# Serve fonts and font-related file types
types {
    text/javascript .js
    image/webp .webp
    image/x-icon .ico
    image/svg+xml .svg
    application/font-woff woff;
    application/font-woff2 woff2;
    application/vnd.ms-fontobject eot;
    font/opentype otf;
    font/truetype ttf;
}

# END Gzip Compression

# BEGIN Caching
location / {
    expires 300s;

    # No caching for PHP files
    location ~* \.php$ {
        expires epoch;
        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0";
    }

    # Caching for favicon.ico
    location = /favicon.ico {
        expires 2592000s;
    }
}

# END Caching

# BEGIN Spelling
# This module is not available for nginx
# END Spelling

# BEGIN URL rewrite
location / {
    rewrite ^/(.*)\.js$ /$1.js.gz break;
    if ($request_filename ~* "\.(js|css)$") {
        add_header Content-Encoding gzip;
    }

    # Rewrite all other requests to index.php
    if (!-e $request_filename) {
        rewrite ^/(.*)$ /?${query_string} last;
    }
}

# Redirect to HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    # ... other SSL-related configuration

    # Normal server configuration
    location / {
        # ... server configuration for non-SSL requests
    }
}

# END URL rewrite

# BEGIN Access control
location ~ \.php$ {
    deny all;
    allow 127.0.0.1;
}

location /index.php {
    allow all;
}

# Disable directory view
location / {
    autoindex off;
}

# Disable unsupported scripts
location ~ \.(pl|py|jsp|asp|shtml|sh|cgi)$ {
    deny all;
}

#<ifmodule mod_headers.c>
#    # XSS protection
#    add_header X-XSS-Protection "1; mode=block";
#
#    # Nosnif
#    add_header X-Content-Type-Options "nosniff";
#
#    # Iframes only from self
#    add_header X-Frame-Options "SAMEORIGIN";
#</ifmodule>

location = /ServiceWorker.js {
    add_header Service-Worker-Allowed "/";
}

# Php config
# This should be removed from here and adjusted in the php.ini file
php_value upload_max_filesize 40M;
php_value post_max_size 40M;
php_value memory_limit