0

Hello i hope someone can help me because i tried every configuration possible. I looked around the internet a lot and there were many variations of how to use location block to prevent someone from accessing php files and none of them worked... Finally i found this:

server {

server_name mywebsite.com   www.mywebsite.com;


access_log /var/log/nginx/mywebsite.com.access.log rt_cache;
error_log /var/log/nginx/mywebsite.com.error.log;


root /var/www/mywebsite.com/htdocs;



index index.php index.html index.htm;


include common/wpfc-php7.conf;

include common/wpcommon-php7.conf;
include common/locations-php7.conf;
include /var/www/mywebsite.com/conf/nginx/*.conf;

limit_req zone=one burst=8;
limit_conn two 2;

    location ~ (.php|.aspx|.asp|myadmin|wp-includes|wp-content) {
            return 301;
    }

    location ~ /(wp-admin|wp-login) {
            allow my.ip;
            limit_req zone=one burst=50;
            deny all;
    }
    location = /xmlrpc.php {
            deny all;
    }

}

Now this code works like it should. If i try to access aspx,asp on ANY folder i get 301 if i try to access ANYTHING in wp-includes,wp-content i get 301 HOWEVER if i try to access php i get 404. What am i doing wrong ?

3
  • Please post the complete server block. Aug 1, 2018 at 17:50
  • Posted a complete server block @MichaelHampton
    – xPalis
    Aug 1, 2018 at 18:24
  • With Nginx caching you need to make sure the headers sent by the PHP app are correct, or rewrite them in Nginx if required. Reference here. That's not your current problem though.
    – Tim
    Aug 1, 2018 at 19:33

1 Answer 1

0

If you want to catch all files with extensions like .php, .asp, .aspx you can try regular expression line this ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) into your location. See example on regex101.com.

So your location should look like this:

location ~ ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) {
    return 301;
}

another place to check code is

https://nginx.viraptor.info/ with full condif

server {
 listen       80;
 server_name  example.com;

 location ~ ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) {
   return 301;
 }
}

and tested url http://example.com/something.php

enter image description here

7
  • Thank you for your time and answer however code block shown in my post at least catches asp and aspx requests, your code doesnt work AT ALL :/
    – xPalis
    Aug 1, 2018 at 18:20
  • It's interesting:) I've checked your full conf at nginx.viraptor.info for url like mywebsite.com/something.php and got as result matching to location suggested by me. Can you specify which part of the code doesn't work. Aug 1, 2018 at 18:40
  • I copied the server block to nginx.viraptor.info and tried url mywebsite.com/images/asda.php that worked... However on my website it doesnt... it catches asp aspx file request, wp-includes,wp-content but NOT php files... i seriously dont get it why is this happening
    – xPalis
    Aug 1, 2018 at 18:50
  • Can you add to your post another included *.conf files (common/wpfc-php7.conf, common/wpcommon-php7.conf and others)? Maybe answer is there Aug 1, 2018 at 18:55
  • Im not a very brith person :D in wpfc-php7.conf i found this.. location ~ \.php$ { try_files $uri =404; include fastcgi_params; fastcgi_pass php7; fastcgi_cache_bypass $skip_cache; fastcgi_no_cache $skip_cache; fastcgi_cache WORDPRESS; } That makes sense now why i get 404. Question is.. what if i delete this block ?
    – xPalis
    Aug 1, 2018 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .