Ngin vhost config file

nginx.conf

# Map the Header Accept to the webp format
map $http_accept $webp_suffix {
	"~*webp"  ".webp";  
}
# Path to the directory to store the fastcgi cache files
 fastcgi_cache_path                    /tmp/cache/example levels=1:2 keys_zone=pmquest:23m max_size=1g inactive=60m;

# redirect http to https
server {
	listen                                80;
	listen                                [::]:80;

	server_name                           example.com;
	server_name                           www.example.com;

	return                                301 https://example.com$request_uri;
}

server {
	listen                                [::]:443 http2 ssl ipv6only=on; # managed by Certbot
	listen                                443 http2 ssl; # managed by Certbot

	server_name                           example.com www.example.com;

	set                                   $no_cache 0;

	root                                  /var/www/example/public;

	# Add index.php to the list if you are using PHP
	index                                 index.php index.html index.htm index.nginx-debian.html;

	# cache.appcache, your document html and data
	location ~* \.(?:manifest|appcache|html?|xml|json)$ {
		expires                              -1;
	}

	# Feed
	location ~* \.(?:rss|atom)$ {
		expires                              1h;
		add_header                           Cache-Control "public";
	}

	# Media: images, icons, video, audio, HTC
	location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
		expires                              1M;
		access_log                           off;
		add_header                           Vary Accept ;
		add_header                           Cache-Control "public";
		try_files                            $uri$webp_suffix $uri =404;
	}

	# CSS and Javascript
	location ~* \.(?:css|js)$ {
		expires                              1y;
		access_log                           off;
		add_header                           Cache-Control "public";
	}

	# Serve website using index.php
	location / {
		try_files                            $uri $uri/ /index.php?$query_string;
	}

	# pass PHP scripts to FastCGI server
	location ~ \.php$ {
		fastcgi_split_path_info              ^(.+\.php)(/.+)$;

		### Server Cache Related ###

		fastcgi_cache                        example;

		# Cache only 200 responses, cache for 60 minutes
		fastcgi_cache_valid                  200 301 302 60m;
		fastcgi_cache_use_stale              error timeout updating invalid_header http_500 http_503;
		fastcgi_cache_min_uses               1;
		fastcgi_cache_lock                   on;

		#Only GET and HEAD methods apply
		fastcgi_cache_methods                GET HEAD;
		add_header                           X-Fastcgi-Cache $upstream_cache_status;

		# Don't save to cache based on $no_cache
		fastcgi_no_cache                     $no_cache;
		try_files                            $uri /index.php =404;

		#include snippets/fastcgi-php.conf;
		fastcgi_split_path_info              ^(.+\.php)(/.+)$;

		### PHP - FPM related
		fastcgi_pass                         unix:/var/run/php/php7.3-fpm.sock;
		fastcgi_index                        index.php;
		fastcgi_param                        SCRIPT_FILENAME $request_filename;
		include                              fastcgi_params;
	}

	ssl_certificate                       /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
	ssl_certificate_key                   /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
	#  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam                           /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

	# RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
	#ssl_dhparam                          /etc/ssl/ffdhe4096.pem;
	ssl_ecdh_curve                        secp521r1:secp384r1;

	# Enable server-side protection against BEAST attacks
	ssl_protocols                         TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers             on;
	ssl_ciphers                           "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384";
	# ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

	# Improve HTTPS performance with session resumption
	ssl_session_cache                     shared:SSL:10m;
	ssl_session_timeout                   10m;

	# Aditional Security Headers
	# ref: https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
	add_header                            Strict-Transport-Security "max-age=31536000; includeSubDomains";

	# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
	add_header                            X-Frame-Options DENY always;

	# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
	add_header                            X-Content-Type-Options nosniff always;

	# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
	add_header                            X-Xss-Protection "1; mode=block" always;

	#  Enable OCSP stapling
	#  ref. http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox
	ssl_stapling                          on;
	ssl_stapling_verify                   on;
	ssl_trusted_certificate               /etc/letsencrypt/live/example.com/fullchain.pem;
	#resolver                             1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] valid=300s; # Cloudflare
	resolver                              127.0.0.1;
	resolver_timeout                      5s;

	# Required for LE certificate enrollment using certbot
	location '/.well-known/acme-challenge' {
		default_type                         "text/plain";
	}
}