Recipes

Disable mod_rewrite

Having ported the firewall to mod_setenvif, it is possible to also dispense with any remaining rewrite rules. Follow these steps:

1. Using mod_rewrite for permalink settings is a relic from httpd 2.2. The same effect can now be achieved with mod_dir:

# This still takes precedence over nG-SetEnvIf.
SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
FallbackResource /index.php

2. Rules for access control can switch to using mod_setenvif or Cloudflare’s free-tier WAF.

Wordpress-specific recipes

Rate-limit 404s

nG deals in 403s. To fend off excessive 404s, use Wordfence. For best performance, opt out of ‘extended protection’.

Use Cloudflare

Whether used primarily for page caching or DDoS mitigation, Cloudflare can complement the functionality of nG-SetEnvIf.

Origin pulls

To stop requests circumventing CF proxy, configure httpd for Authenticated Origin Pulls. For best performance, choose the ECC version of private key for origin CA certificate, opt out of root certificate, and set SSLUseStapling to off. Then, comment out Listen 80.

ECDSA vs RSA

In case the primary edge certificate uses RSA, switch to ECDSA by setting certificate authority to lets_encrypt via API call.

WAF

To add additional rules to nG-SetEnvIf, combine them into a Custom Rule for CF’s free-tier WAF. Doing so not only takes advantage of the non-backtracking algorithm of RE2 (as opposed to PCRE used in httpd), but streamlines maintenance when upgrading nG-SetEnvIf.

URL normalisation

Depending on your specific settings, CF’s URL normalisation can take over some of the functionality of nG-SetEnvIf.