Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hopefully an easy one for you nginx gurus out there. I can't find any relevant info on google or the docs, but I hope this is possible.

Essentially, using advice gained from others, we want to prevent PHP from running in our public upload directories. We're accomplishing this like so:

if($uri !~ "^/vb_attach/") {

But on this website, we've got multiple upload directories. I know that nginx doesn't support && or || in the conditional, so we tried this:

    if ($uri !~ "^/vb_attach/") {
            if($uri !~ "^/vb_album/") {

but were told that the second if wasn't allowed there. So how can we accomplish this? All we want to do is prevent PHP from executing in these upload directories, just in case someone is able to bypass the checks in the upload scripts.

share|improve this question
up vote 1 down vote accepted

One best-practice way to do this is with location blocks which refuse requests for PHP files.

For example:

server {
  location /vb_attach {
    location ~ \.php$ {return 403;}

  location /vb_album {
    location ~ \.php$ {return 403;}

  location ~ \.php {

The nginx wiki has several alternatives for preventing this particular security issue which you may find useful in other circumstances as well.

share|improve this answer
Thank you! I'd seen some other methods involving setting a variable in the first location check, then concatenating a value in the second location check. Then if variable=AB, pass to FPM. I thought that was really ugly and knew that there had to be a better way. – Kevin Mar 3 '13 at 2:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.