直接给你一套 Linux 上通用、可复制粘贴的 Nginx 最佳配置，包含： 静态站点、PHP/WordPress、反向代理、HTTPS、缓存、安全优化，你按需改域名和路径即可。

1. nginx.conf 主配置（通用优化）

/etc/nginx/nginx.conf

user  nginx;
worker_processes  auto;
worker_rlimit_nofile 65535;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    use epoll;
    worker_connections  10240;
    multi_accept on;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;

    keepalive_timeout  65;
    client_header_timeout 15;
    client_body_timeout 15;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain text/css text/xml text/javascript application/json
        application/javascript application/xml+rss application/rss+xml;

    server_tokens off;
    charset utf-8;

    include /etc/nginx/conf.d/*.conf;
}

2. 纯静态网站 / 前端项目（Vue/React/HTML）

/etc/nginx/conf.d/xxx.com.conf

server {
    listen 80;
    server_name xxx.com www.xxx.com;

    # 强制跳转 HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name xxx.com www.xxx.com;

    ssl_certificate /etc/nginx/ssl/xxx.com.pem;
    ssl_certificate_key /etc/nginx/ssl/xxx.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;

    root /www/xxx.com/dist;
    index index.html;

    # 前端路由 history 模式
    location / {
        try_files $uri $uri/ /index.html;
    }

    # 静态资源缓存
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2|ttf|svg)$ {
        expires 7d;
        add_header Cache-Control "public, max-age=604800";
    }

    # 安全头
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
}

3. WordPress / PHP 项目（最常用）

server {
    listen 80;
    server_name blog.xxx.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name blog.xxx.com;

    ssl_certificate /etc/nginx/ssl/blog.xxx.com.pem;
    ssl_certificate_key /etc/nginx/ssl/blog.xxx.com.key;

    root /www/blog.xxx.com;
    index index.php index.html;

    # WordPress 伪静态
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # PHP 解析
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }

    # 静态缓存
    location ~* \.(css|js|jpg|png|gif|ico|svg|woff2)$ {
        expires 30d;
        add_header Cache-Control public;
    }

    # 禁止访问敏感文件
    location ~ /\.ht { deny all; }
    location ~* wp-config.php { deny all; }
}

4. 反向代理（代理 IIS、.NET、Java、Node）

server {
    listen 80;
    server_name api.xxx.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.xxx.com;

    ssl_certificate /etc/nginx/ssl/api.xxx.com.pem;
    ssl_certificate_key /etc/nginx/ssl/api.xxx.com.key;

    location / {
        proxy_pass http://127.0.0.1:5000;  # 你的后端端口
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 3s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
}

5. 常用命令（直接用）

# 测试配置是否正确
nginx -t

# 重启
systemctl restart nginx

# 重载（不中断服务）
systemctl reload nginx

# 开机自启
systemctl enable nginx

# 查看日志
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

你告诉我三件事，我可以直接给你生成专属完整配置，改下域名就能上线：

1. 你要跑的是：静态 / WordPress / .NET / Java / Node？
2. 域名是什么？
3. 后端端口是多少（如果是反向代理）？