Recently I discovered my server is outputting php code out. The cause is that nginx is working but the php-fpm is not. As you can imagine this can be a serious security threat.
So is there a way to prevent nginx to serve php files unless it is receiving response from the php engine? I think it is some simple tweak in nginx.conf but I haven't sort that out yet.Hope someone can help!
server {
listen 80;
server_name example.com;
location / {
root /usr/share/nginx/html;
index index.php index.html index.htm;
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
root /usr/share/nginx/html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
fastcgi_pass
shouldn't fallback to serving the PHP as a static file like that.