What a control panel writes into nginx for WordPress: auraPanel and CloudPanel side by side

Why look at this

A control panel's most consequential output is the web-server configuration it writes for you. It decides which requests are refused, how PHP is reached, what is cached and for how long, which headers every visitor receives, and how much of the WordPress attack surface is closed before PHP ever runs. Two panels can advertise the same features and write very different server blocks.

This study puts the block auraPanel renders for a WordPress site next to the WordPress template CloudPanel publishes, directive by directive. It is a reading of configuration, not a benchmark: nothing here says which serves pages faster.

What was compared

• auraPanel: the file nginx loads for a production WordPress site on this host, rendered by the panel from its wordpress template with the site's options (force HTTPS on, bad-bot block on, Cloudflare edge shield on, page cache off, login throttling off). The domain is shown as example.com; a site-specific drop-in the operator had added is removed.
• CloudPanel: v2/WordPress/WordPress from cloudpanel-io/vhost-templates, which CloudPanel's vhost documentation says is "automatically updated every night". Placeholders such as {{server_name}} are CloudPanel's own.

auraPanel's rendered block

map $http_user_agent $aurapanel_bad_bot_example_com {
    default 0;
    "~*(ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)" 1;
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    location ^~ /.well-known/acme-challenge/ {
        alias /var/lib/aurapanel/acme/;
        default_type "text/plain";
        try_files $uri =404;
    }
    location / { return 301 https://$host$request_uri; }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com www.example.com;
    root /home/example/htdocs/example.com;
    index index.php index.html;
    ssl_certificate /etc/aurapanel/ssl/example.com.crt;
    ssl_certificate_key /etc/aurapanel/ssl/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    location ^~ /.well-known/acme-challenge/ { alias /var/lib/aurapanel/acme/; default_type "text/plain"; try_files $uri =404; }
    access_log /home/example/logs/access.log;
    error_log /home/example/logs/error.log;
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
    server_tokens off;
    location ~* \.log(\.\d+|\.gz)?$ { deny all; access_log off; log_not_found off; }
    include /etc/nginx/aura-redirects.d/example.com/*.conf;
    client_max_body_size 64m;
    if ($aurapanel_bad_bot_example_com) { return 403; }
    # Cloudflare Edge Shield — accept origin traffic from the CDN edge only
    set_real_ip_from 173.245.48.0/20;   # … 21 more Cloudflare ranges
    real_ip_header CF-Connecting-IP;
    real_ip_recursive on;
    set $edgeshield_block 1;
    if ($edgeshield_cloudflare) { set $edgeshield_block 0; }
    if ($edgeshield_self) { set $edgeshield_block 0; }
    if ($uri ~ "^/\.well-known/acme-challenge/") { set $edgeshield_block 0; }
    if ($edgeshield_block) { return 403; }
    location ~ /\.(?!well-known) { deny all; }
    location = /xmlrpc.php { deny all; }
    location ~ ^/wp-content/uploads/.*\.php$ { deny all; }
    if (!-e $request_filename) {
        rewrite /wp-admin$ $scheme://$host$uri/ permanent;
        rewrite ^(/[^/]+)?(/wp-.*) $2 last;
        rewrite ^(/[^/]+)?(/.*\.php)$ $2 last;
    }
    location / { try_files $uri $uri/ /index.php?$args; }
    location ~* \.(css|js|jpg|jpeg|gif|png|ico|svg|woff|woff2|ttf|otf|webp|webm|mp4)$ {
        rewrite ^/[_0-9a-zA-Z-]+(/wp-.*) $1 break;
        rewrite ^/[_0-9a-zA-Z-]+(/.*\.php)$ $1 break;
        expires max;
        access_log off;
        add_header Cache-Control "public, immutable";
    }
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php-fpm/example.com.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_read_timeout 300s;
    }
}

Globally, on the same host: server_tokens off, gzip on (level 5, 1 KB minimum, the usual text types), TLS session cache shared with tickets off, open_file_cache, a limit_req_zone keyed on host plus client IP for WordPress, Joomla and Drupal login paths at 2 requests a second (applied only when a site turns login throttling on), and the FastCGI and proxy cache zones that a site's page cache uses when enabled. nginx 1.31.2 here is built with http_v2, http_v3, realip and gzip_static; no Brotli or PageSpeed modules.

Directive by directive

Reading it

• Shared ancestry. The multisite rewrites, the asset rewrites and the front controller are the same lines in both. Anyone who has hand-written a WordPress server block will recognise either file.
• auraPanel puts more hardening in the block itself: security headers, dotfile and log denial, PHP-in-uploads denial, an ACME location that does not depend on the document root, and optional bot, origin-lock and login-throttling layers. Some of these may exist in CloudPanel's global configuration; they are not in the WordPress template.
• CloudPanel is ahead on transport features: HTTP/3 is documented as available, and the PageSpeed module and Varnish are part of its stack. auraPanel's nginx carries the HTTP/3 module but the panel does not switch it on — a gap this study makes visible.
• Two design choices differ rather than rank. Unix sockets versus TCP ports for PHP-FPM, and PHP settings in the pool versus in nginx via PHP_VALUE. Sockets avoid the loopback stack; ports make the pool reachable from elsewhere. Pool-level php_admin_value cannot be overridden by the application; PHP_VALUE can be, which is sometimes wanted.
• Two details worth checking in CloudPanel's template: the HTTPS redirect uses $uri, which drops the query string, and Access-Control-Allow-Origin "*" is set on every static asset type, which is convenient for fonts across subdomains and broader than most sites need.
• The FastCGI read timeout is 300 seconds in auraPanel and 3600 in CloudPanel. Longer tolerates slow admin actions; shorter frees workers from stuck requests sooner. Neither is wrong; they are different bets.

Limitations

• One rendered file from one site with a particular set of options; CloudPanel's template with no options applied. Rendered-to-rendered on two fresh servers would be the fairer comparison, and is planned when test servers are available.
• CloudPanel's global nginx.conf was not reviewed; "not in template" is not "absent from CloudPanel".
• The CloudPanel template was last changed on 14 January 2026 and read on 17 September 2026; it may have changed since. The link goes to the live file.
• Configuration says nothing about throughput or latency. No requests were timed.
• The reviewer works on auraPanel. Every line quoted from CloudPanel's template is verbatim so that the reading can be checked.

Reproduce it

# auraPanel: the file nginx loads for a site
sudo cat /etc/nginx/sites-available/<domain>.conf
sudo /usr/sbin/nginx -V 2>&1 | tr ' ' '\n' | grep -E 'http_v3|http_v2|brotli|pagespeed'
grep -nE 'gzip|limit_req_zone|ssl_session' /etc/nginx/nginx.conf

# CloudPanel: the published template
curl -sL https://raw.githubusercontent.com/cloudpanel-io/vhost-templates/master/v2/WordPress/WordPress