Hello i hope someone can help me because i tried every configuration possible. I looked around the internet a lot and there were many variations of how to use location block to prevent someone from accessing php files and none of them worked... Finally i found this:
server {
server_name mywebsite.com www.mywebsite.com;
access_log /var/log/nginx/mywebsite.com.access.log rt_cache;
error_log /var/log/nginx/mywebsite.com.error.log;
root /var/www/mywebsite.com/htdocs;
index index.php index.html index.htm;
include common/wpfc-php7.conf;
include common/wpcommon-php7.conf;
include common/locations-php7.conf;
include /var/www/mywebsite.com/conf/nginx/*.conf;
limit_req zone=one burst=8;
limit_conn two 2;
location ~ (.php|.aspx|.asp|myadmin|wp-includes|wp-content) {
return 301;
}
location ~ /(wp-admin|wp-login) {
allow my.ip;
limit_req zone=one burst=50;
deny all;
}
location = /xmlrpc.php {
deny all;
}
}
Now this code works like it should. If i try to access aspx,asp on ANY folder i get 301 if i try to access ANYTHING in wp-includes,wp-content i get 301 HOWEVER if i try to access php i get 404. What am i doing wrong ?
server
block.