i'm trying to add a captcha in my wordpress login page. i get 500 internal error in firefox console when inspecting the page. i also have this in my nginx error logs:
FastCGI sent in stderr: "PHP message: PHP Warning: Use of undefined constant ‘FS_METHOD’ - assumed '‘FS_METHOD’' (this will throw an Error in a future version of PHP)
these are some parts of my configs:
nginx site config:
server {
listen 443 ssl http2;
server_name example.com;
set $base /var/www/html/mysite;
root $base/public;
# restrict methods
if ($request_method !~ ^(GET|POST|HEAD)$) {
return '444';
}
# index.php
index index.php;
# index.php fallback
location / {
try_files $uri $uri/ /index.php?$args;
}
# additional config
include /etc/nginx/general.conf;
include /etc/nginx/wordpress.conf;
# handle .php
#location ~ \.php$ {
# fastcgi_pass unix:/var/run/php/php-fpm/php7.4-fpm.sock;
# include /etc/nginx/php_fastcgi.conf;
#}
location ~ \.php$ {
#try_files $uri =404;
include /etc/nginx/php_fastcgi.conf;
fastcgi_pass unix:/var/run/php/php-fpm/php7.4-fpm.sock;
#include fastcgi_params;
}
wordpress config:
# WordPress: allow TinyMCE
location = /wp-includes/js/tinymce/wp-tinymce.php {
include /etc/nginx/php_fastcgi.conf;
}
# WordPress: deny wp-content, wp-includes php files
location ~* ^/(?:wp-content|wp-includes)/.*\.php$ {
deny all;
}
# WordPress: deny wp-content/uploads nasty stuff
location ~* ^/wp-content/uploads/.*\.(?:s?html?|php|js|swf)$ {
deny all;
}
# WordPress: SEO plugin
location ~* ^/wp-content/plugins/wordpress-seo(?:-premium)?/css/main-sitemap\.xsl$ {}
# WordPress: deny wp-content/plugins (except earlier rules)
location ~ ^/wp-content/plugins {
deny all;
}
# WordPress: deny general stuff
location ~* ^/(?:xmlrpc\.php|wp-links-opml\.php|wp-config\.php|wp-config-sample\.php|readme\.html|license\.txt)$ {
deny all;
}
and security config:
# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# . files
location ~ /\.(?!well-known) {
deny all;
}