Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
 location ~ \..*/.*\.php$ 
   return 403;

I am interpreting this as: case sensitive .[any character repeated 0 or more times]/[any character repeated 0 or more times].php




I don't understand why I need this for drupal


share|improve this question
up vote 2 down vote accepted

you're right case sensitive matching .anything/anything.php. i believe it's for security reason. in case someone make/upload malicious hidden file or dir (in *nix, file/dir start with "." dot mean hidden file), it will return http 403 (forbidden)

share|improve this answer

It's intended to block any requests for a .php file in a directory beginning with a dot. These files can appear in .svn directories, for example, where a clever hacker could manage to run an old version of a file. There are also circumstances where you might have a .drush directory within your docroot, which could also contain .php files you won't want run in the context of the web server.

It certainly won't hurt the vast majority of cases to allow this rule to continue to be in place, and depending on what you have sitting around in your docroot, the gain in security might be substantial.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.