Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know if this can be achieved... I'll try anyway. I'd like to deny php files in a certain folder to be viewable if loaded directly (you point the browser to the direct URL), but only if you clicked on a link pointing to them on a certain page. Can this be achieved in nginx with a location..? It's nothing security involved, so if the method isn't 100% secure it's not a problem..

EDIT: Ok, let's add some details.. I have a VPS and I have a page with a login box. After you enter the login details you access to a page with links to phpinfo/phpsysinfo/webmin panel/apc status/nginx status. So a page where you have links to software to monitor stats of my VPS. I know that security through obscurity isn't ok but I feel more confortable to have those info not really exposed. So I'd like to deny access to those pages (all in 1 directory) denying direct access (but only if you come from the page protected by login box).

share|improve this question
It would help a bit if you could be more specific as to what you're trying to do. – Michael Hampton Sep 24 '12 at 21:54
Thanks for your interest. Added details. :) – MultiformeIngegno Sep 24 '12 at 22:10
Why not simply do HTTP-based basic authentication? – Zoredache Sep 24 '12 at 22:46
up vote 0 down vote accepted

What you're describing is based on the HTTP_REFERER header. If you could do this with Nginx, you'd have to do it with an if block, which would be inefficient. I'm not sure you could do it any other way. But you shouldn't be doing this anyway as, as you said, it isn't really secure, just hidden.

You should look at these:

Digest would be more secure. Basic transmits user/password in the clear. But either would be far more secure than what you're describing as the pages are actually protected.

share|improve this answer
Thanks! Going to try this as soon as I can! Will accept the answer that works. :) – MultiformeIngegno Sep 25 '12 at 21:47
Ok, the HttpAuthBasicModule seems to work.. the problem is that after I insert the credentials instead of displaying the php files protected by the httpauth module the browser downloads the file.. there seems to be a problem with MIME. This is the interesting portion I have in nginx vhost: – MultiformeIngegno Sep 25 '12 at 22:21
I think you need a try_files in your location ^~ /stats/ after the auth lines. – Luke Sep 25 '12 at 22:28
Uhm.. added try_files $uri $uri/ index.php; with no luck.. :( – MultiformeIngegno Sep 25 '12 at 22:29
Any hint..? Fixed this problem everything works! :) – MultiformeIngegno Sep 25 '12 at 22:43

Looking here might be what you're after:

The following would redirect all direct requests to the 403 forbidden page.

error_page  403;
location / {
  deny    all;

Of course you can still access that code from your another PHP script if you wish, it just prevents external direct access.

share|improve this answer
Thanks! Going to try this as soon as I can! Will accept the answer that works. :) – MultiformeIngegno Sep 25 '12 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.