Nginx complete folder protection not working

Question

I have installed nginx(1.4.3) with PHP-FPM(5.4.20). i want to protect my wordpress wp-admin folder.

my nginx configuration file domain.conf:

server {
    listen 80;
    server_name  example.com;
    root /var/www;
    location / {
    index  index.php;
    try_files $uri $uri/ /index.php?$args;
    }

    location /wp-admin {
    index   index.php;
    allow   192.168.1.2;
    deny    all;
    }
    location ~ \.php$ {
    fastcgi_pass   127.0.0.1:9000;
    fastcgi_index  index.php;
    fastcgi_param  PATH_INFO $fastcgi_script_name;
    fastcgi_param  SCRIPT_FILENAME  /var/www$fastcgi_script_name;
    include        fastcgi_params;
    }
}

Problem: When i load wp-admin folder in different ip i got 403(fine), but i'm able to load insite PHP files. like /wp-admin/about.php

Answer 1

When you access /wp-admin/about.php, the PHP location block processes the request. Not the /wp-admin block.

To achieve what you'd want, you'd need a PHP location block and try_files directive inside /wp-admin block. Here's the generic solution for your use case!

server {
  location / {
  }

  location /wp-admin {
    # try_files ...;
    # allow   ip.ip.ip.ip;
    # deny    all;

    location ~* \.php$ {
      # directives to process PHP inside wp-admin
    } 
  }

  location ~* \.php$ {
    # directives to process PHP outside wp-admin
  }
}