NGINX: Returning 403 on .php files

Question

I'm trying to serve the static files from a Wordpress installation and I'm using a symbolic link placed in the NGINX folder pointing to the wp-content/uploads folder.

Every file is being served correctly, but unfortunately there are some plugins that include some of their .php files inside this folder, so NGINX serve them as static files, leading to potential security risks.

Is there any way to instruct NGINX to return a Forbidden 403 error when trying to access .php files?

Thanks in advance.

Dayo · Accepted Answer · 2011-09-20 19:35:24Z

1

You can exclude an extension under a location block using a sub location

E.G.

location /wp-content/uploads { location ~ \.(php|any|other|ext)$ { return 403; } .... }

answered Sep 20, 2011 at 19:35

Dayo

12.9k5 gold badges57 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Daniel Garcia Over a year ago

thanks for your answer! noob subquestion, should I just add it to the .htaccess file? It didn't work for me that way.

Dayo Over a year ago

Nginx does not use htaccess files. You add the above to the nginx conf file for the site in question and reload nginx.

Collectives™ on Stack Overflow

NGINX: Returning 403 on .php files

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related