This is what i did to make it work on my froxlor installation:
1. Login to Froxlor as Administrator
2. Impersonate your wordpress customer by clicking on Customers -> [his username]
3. As Customer click on Domain -> Settings -> [the small edit pensil to edit this domain]
4. Change "Openbasedir-Path" to "Homefolder" - this will **allow** PHP to **access** all files **from this customer**!
5. Wait for the froxlor crontask or run it manually
6. Login to your wordpress backend.
7. Goto Security->Settings and search for nginx, change the nginx config path to "/var/customers/webs**/[customer-name]**/**[domain-name]**/nginx.conf" and save, it should give a message about a sucessfull write of the nginx.conf!
8. Go back to the Froxlor Administrator Panel
9. Go to Domains -> [small edit pensil to edit your customers domain]
10. Insert "include /var/customers/webs/[customer-name]/[domain-name]/nginx.conf;" to his "Own vHost-Settings"
11. Wait for the froxlor contask again.
12. Voila, now you have improved yours/your customers wordpress installation even more.
### Deprecated Method:
Took me a while to convert the Nginx rules from iThemes to "plain" Text so i could past them into froxlor.
This is what came out.
<preclass="brush:plain;">
# BEGIN iThemes Security
# BEGIN Tweaks
# Rules to block access to WordPress specific files and wp-includes
location ~ /\.ht { deny all; }
location ~ wp-config.php { deny all; }
location ~ readme.html { deny all; }
location ~ readme.txt { deny all; }
location ~ /install.php { deny all; }
location ^wp-includes/(.*).php { deny all; }
location ^/wp-admin/includes(.*)$ { deny all; }
# Rules to prevent php execution in uploads
location ^(.*)/uploads/(.*).php(.?){ deny all; }
# Rules to block unneeded HTTP methods
if ($request_method ~* "^(TRACE|DELETE|TRACK)"){ return 403; }
# Rules to block suspicious URIs
set $susquery 0;
if ($args ~* "\.\./") { set $susquery 1; }
if ($args ~* "\.(bash|git|hg|log|svn|swp|cvs)") { set $susquery 1; }
if ($args ~* "etc/passwd") { set $susquery 1; }
if ($args ~* "boot.ini") { set $susquery 1; }
if ($args ~* "ftp:") { set $susquery 1; }
if ($args ~* "http:") { set $susquery 1; }
if ($args ~* "https:") { set $susquery 1; }
if ($args ~* "(<|%3C).*script.*(>|%3E)") { set $susquery 1; }
if ($args ~* "mosConfig_[a-zA-Z_]{1,21}(=|%3D)") { set $susquery 1; }
if ($args ~* "base64_encode") { set $susquery 1; }
if ($args ~* "(%24&x)") { set $susquery 1; }
if ($args ~* "(127.0)") { set $susquery 1; }
if ($args ~* "(globals|encode|localhost|loopback)") { set $susquery 1; }
if ($args ~* "(request|insert|concat|union|declare)") { set $susquery 1; }
if ($args !~ "^loggedout=true"){ set $susquery 0; }
if ($args !~ "^action=jetpack-sso"){ set $susquery 0; }
if ($args !~ "^action=rp"){ set $susquery 0; }
if ($http_cookie !~ "^.*wordpress_logged_in_.*$"){ set $susquery 0; }
if ($http_referer !~ "^http://maps.googleapis.com(.*)$"){ set $susquery 0; }