Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a wordpress site under /wp directory, with nginx web server.I want to restrict /wp/wp-admin files to my private ip adresses and return an error to unathorised clients. the problem is wp-admin folder can be easily restricted but files are still reachable!

server {
    root   /usr/share/nginx/html;
    index  index.html index.htm index.php;
    listen       80;
    server_name  localhost;

    #charset koi8-r;
    #access_log  /var/log/nginx/log/host.access.log  main;

location /main {
        index index.php;
        try_files $uri $uri/ /wp/index.php?q=$uri;

    error_page   500 502 503 504 404 403 400 /error.html;
    location = /error.html {
        root   /usr/share/nginx/html;

    location ~ \.php$ {
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
share|improve this question
This is not a question about iptables, you should use more accurate tags like nginx. – Kyle Smith Feb 23 '12 at 12:20

The way to do this is with a location stanza in your config file, such as:

location /wp/wp-admin/ {
  deny all;

Your question made it sound as though you had tried this already without success though? Can you post your exact configuration for this directory?

share|improve this answer
above configuration will restrict access on /wp/wp-admin, but php scripts can be executed under this directory. e.g. /wp/wp-admin/script.php i want to restrict access to everything under this directory including php script, images, js ,... – user111701 Feb 23 '12 at 18:50
There is a difference between location = /wp/wp-admin/ and location /wp/wp-admin/. The first will only be for exactly a request of /wp/wp-admin/, while the latter will match anything starting with /wp/wp-admin/. – Kyle Smith Feb 23 '12 at 20:40
If I place it below my fast-cgi parameters nothing happens but if I place it above my fast-cgi parameters, it denys well but allowed ip addresses wil see the php sources – user111701 Feb 24 '12 at 9:39
Please post your configuration in your original question, all I can do now is guess. – Kyle Smith Feb 24 '12 at 13:06
I've added my configuration file to above post.please check it – user111701 Mar 3 '12 at 11:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.