Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed nginx(1.4.3) with PHP-FPM(5.4.20). i want to protect my wordpress wp-admin folder.

my nginx configuration file domain.conf:

server {
    listen 80;
    server_name  example.com;
    root /var/www;
    location / {
    index  index.php;
    try_files $uri $uri/ /index.php?$args;
    }

    location /wp-admin {
    index   index.php;
    allow   192.168.1.2;
    deny    all;
    }
    location ~ \.php$ {
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  PATH_INFO $fastcgi_script_name;
    fastcgi_param  SCRIPT_FILENAME  /var/www$fastcgi_script_name;
    include        fastcgi_params;
    }
}

Problem: When i load wp-admin folder in different ip i got 403(fine), but i'm able to load insite PHP files. like /wp-admin/about.php

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

When you access /wp-admin/about.php, the PHP location block processes the request. Not the /wp-admin block.

To achieve what you'd want, you'd need a PHP location block and try_files directive inside /wp-admin block. Here's the generic solution for your use case!

server {
  location / {
  }

  location /wp-admin {
    # try_files ...;
    # allow   ip.ip.ip.ip;
    # deny    all;

    location ~* \.php$ {
      # directives to process PHP inside wp-admin
    } 
  }

  location ~* \.php$ {
    # directives to process PHP outside wp-admin
  }
}
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.