# Server configuration

> For whoever manages the server: the rule nginx needs for private folders, upload limits and timeouts (including Cloudflare and Docker), the request DooFiles makes to your own site, scheduled tasks, page caches and file permissions.

Source: https://doothemes.com/docs/doofiles/guides/server-configuration

---

## Overview

DooFiles works on most servers without any change. This guide is for the cases that need a hand from whoever manages the server: nginx, slow or proxied uploads, sites that cannot reach themselves, scheduled tasks and caches.

If you do not manage your server, send this page to your hosting provider.

## nginx and private folders

[Private folders](https://doothemes.com/docs/doofiles/security/private-folders) are closed with rules that Apache, LiteSpeed and IIS read on their own. nginx does not read them. Before a folder becomes private, DooFiles checks with a real request that the server keeps it closed. On nginx, the check fails, nothing changes, and DooFiles shows you the exact rule to add.

The rule looks like this, with the path of your folder:

```nginx
location ^~ /client-files/ {
    deny all;
}
```

1. Copy the rule that DooFiles shows. Use that one: it has the exact path of your folder.
2. Add it inside the `server` block of your site, before other `location` blocks.
3. Check the configuration and reload nginx:

```bash
sudo nginx -t && sudo systemctl reload nginx
```

4. In DooFiles, try again.

On hosting panels that manage nginx for you, look for an option such as "Additional nginx directives" or "Custom nginx configuration", or ask your provider to add the rule.

### The Trash and backups folder

The first time you make a folder private, DooFiles also checks its own Trash and backups folder, inside `wp-content`, because files from private folders pass through it. If your server serves it, DooFiles shows a rule for that folder too. Add it the same way. You can see its state any time in the **Private folders** card of **DooFiles › Settings**.

### Apache without .htaccess

Some Apache servers are set to ignore `.htaccess` files (`AllowOverride None`). DooFiles detects it with the same check and shows the folder as open. Ask your provider to allow `.htaccess` in your site, or to deny access to the folder in the configuration of Apache.

## Uploads

You do not need to raise the upload limits of PHP for large files. DooFiles sends files over 1 MB in parts of up to 8 MB, sized to finish in about 20 seconds on your connection, and retries a part that fails. Some servers still need a look.

### nginx: the size of each request

nginx accepts requests of up to 1 MB by default (`client_max_body_size`). DooFiles notices it and sends smaller parts, but uploads are faster with room for a full part:

```nginx
client_max_body_size 16m;
```

### Long requests and timeouts

Servers cut requests that take too long. On a slow connection, with several files at a time, a part can take longer than a server allows. DooFiles retries with smaller parts, but if uploads keep failing with *The server answered with an error (502)*, *(504)* or *(524)*, give requests more time:

| Server | Setting | Suggested |
|---|---|---|
| PHP | `max_input_time` and `max_execution_time` | `300` |
| Apache | `Timeout` | `300` |
| nginx with PHP-FPM | `client_body_timeout` and `fastcgi_read_timeout` | `300s` |
| nginx as a proxy | `client_body_timeout` and `proxy_read_timeout` | `300s` |

For PHP, add these lines to your `php.ini`, or to a `.user.ini` file in the folder of WordPress if your hosting supports it:

```ini
max_input_time = 300
max_execution_time = 300
```

### Docker and the official WordPress image

In Docker images such as the official WordPress image, add a file with those settings to the PHP configuration folder of the container, for example as a mounted file:

```text
/usr/local/etc/php/conf.d/doofiles.ini
```

Then restart the container.

### Behind Cloudflare or another proxy

A proxy sits between your visitors and your server, and shows its own error when your server takes too long or closes the connection. A *502* behind Cloudflare usually means that your server cut the request, not Cloudflare.

- Cloudflare waits up to 100 seconds for your server to answer, and accepts requests of up to 100 MB on its free plan. DooFiles sends parts of 8 MB or less, well within that.
- If uploads fail behind a proxy, raise the timeouts of your server in the table above.

## Your site must be able to reach itself

To check that a private folder is closed, your server sends a request to your own site. It first uses the address of your site, and if that fails, it asks the web server on the same machine directly.

The check fails when your server cannot reach your site, for example:

- a firewall blocks the server from connecting to its own public address;
- the site is behind a password prompt of the server (HTTP authentication), as many staging sites are;
- the domain does not point to the server yet.

DooFiles then shows *DooFiles could not check that the folder is closed to the web (the site could not reach itself), so nothing was changed.* Fix the cause, or ask your provider, and try again.

## Scheduled tasks

DooFiles uses the scheduled tasks of WordPress to empty old items from the Trash, remove old backups and activity, check your license twice a day, measure your folders and check your private folders. WordPress runs them only when someone visits your site.

On sites with few visits, or with `DISABLE_WP_CRON` set to `true` in `wp-config.php`, run them from the server every few minutes, with one of these lines in the crontab:

```bash
*/5 * * * * curl -s https://example.com/wp-cron.php?doing_wp_cron > /dev/null 2>&1
```

```bash
*/5 * * * * cd /path/to/wordpress && wp cron event run --due-now > /dev/null 2>&1
```

Replace the address or the path with yours. **Tools › Site Health** tells you if scheduled tasks are running late.

## Page caches and CDNs

DooFiles works in your WordPress admin and talks to your server through the REST API of WordPress. Page caches and CDNs do not cache those by default. If you use a rule that caches everything, such as *Cache Everything* in Cloudflare, exclude these paths:

```text
/wp-admin/*
/wp-json/*
```

## File permissions

DooFiles can do exactly what PHP is allowed to do on your server. To change a file, the user that runs PHP must be able to write it. A common setup is:

- files and folders owned by the user that runs PHP, or by a group it belongs to;
- `644` for files and `755` for folders.

If the menu shows **View** instead of **Edit** while [read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode) is off, or DooFiles says *The file could not be written. Check the permissions.*, check the owner and the permissions of that file.

## Outgoing connections

Your server must be able to make HTTPS connections to `edge.wupdater.com`, to activate and check your license and to receive updates. Some hosts block outgoing connections by default. See [Requirements](https://doothemes.com/docs/doofiles/requirements#external-services).

## Troubleshooting

| Problem | What to do |
|---|---|
| *This server ignores the rules DooFiles wrote, so the folder can still be opened by URL. Nothing was changed. Add the rule below to the server (nginx) and try again.* | Your server is nginx, or Apache with `.htaccess` turned off. Add the rule that DooFiles shows, reload the server and try again |
| *DooFiles could not check that the folder is closed to the web (the site could not reach itself), so nothing was changed.* | Your server cannot reach your site. See [Your site must be able to reach itself](#your-site-must-be-able-to-reach-itself) |
| Uploads fail with *(502)*, *(504)* or *(524)* | Your server or a proxy cuts long requests. Raise the timeouts in [Long requests and timeouts](#long-requests-and-timeouts) |
| Uploads are slow on nginx | Raise `client_max_body_size` to `16m` |
| Old items are not removed from the Trash | Scheduled tasks are not running. See [Scheduled tasks](#scheduled-tasks) |
| The license cannot reach the Doothemes server | Allow outgoing HTTPS connections to `edge.wupdater.com` |

Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).