0

Hello i hope someone can help me because i tried every configuration possible. I looked around the internet a lot and there were many variations of how to use location block to prevent someone from accessing php files and none of them worked... Finally i found this:

server {

server_name mywebsite.com   www.mywebsite.com;


access_log /var/log/nginx/mywebsite.com.access.log rt_cache;
error_log /var/log/nginx/mywebsite.com.error.log;


root /var/www/mywebsite.com/htdocs;



index index.php index.html index.htm;


include common/wpfc-php7.conf;

include common/wpcommon-php7.conf;
include common/locations-php7.conf;
include /var/www/mywebsite.com/conf/nginx/*.conf;

limit_req zone=one burst=8;
limit_conn two 2;

    location ~ (.php|.aspx|.asp|myadmin|wp-includes|wp-content) {
            return 301;
    }

    location ~ /(wp-admin|wp-login) {
            allow my.ip;
            limit_req zone=one burst=50;
            deny all;
    }
    location = /xmlrpc.php {
            deny all;
    }

}

Now this code works like it should. If i try to access aspx,asp on ANY folder i get 301 if i try to access ANYTHING in wp-includes,wp-content i get 301 HOWEVER if i try to access php i get 404. What am i doing wrong ?

  • Please post the complete server block. – Michael Hampton Aug 1 '18 at 17:50
  • Posted a complete server block @MichaelHampton – xPalis Aug 1 '18 at 18:24
  • With Nginx caching you need to make sure the headers sent by the PHP app are correct, or rewrite them in Nginx if required. Reference here. That's not your current problem though. – Tim Aug 1 '18 at 19:33
0

If you want to catch all files with extensions like .php, .asp, .aspx you can try regular expression line this ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) into your location. See example on regex101.com.

So your location should look like this:

location ~ ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) {
    return 301;
}

another place to check code is

https://nginx.viraptor.info/ with full condif

server {
 listen       80;
 server_name  example.com;

 location ~ ((.*).php|(.*).aspx|(.*).asp|myadmin|wp-includes|wp-content) {
   return 301;
 }
}

and tested url http://example.com/something.php

enter image description here

  • Thank you for your time and answer however code block shown in my post at least catches asp and aspx requests, your code doesnt work AT ALL :/ – xPalis Aug 1 '18 at 18:20
  • It's interesting:) I've checked your full conf at nginx.viraptor.info for url like mywebsite.com/something.php and got as result matching to location suggested by me. Can you specify which part of the code doesn't work. – alexander.polomodov Aug 1 '18 at 18:40
  • I copied the server block to nginx.viraptor.info and tried url mywebsite.com/images/asda.php that worked... However on my website it doesnt... it catches asp aspx file request, wp-includes,wp-content but NOT php files... i seriously dont get it why is this happening – xPalis Aug 1 '18 at 18:50
  • Can you add to your post another included *.conf files (common/wpfc-php7.conf, common/wpcommon-php7.conf and others)? Maybe answer is there – alexander.polomodov Aug 1 '18 at 18:55
  • 1
    Anyway thanks for the help @alexander.polomodov – xPalis Aug 1 '18 at 19:22

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.