2

In my server block in Nginx config, I have put:

location ~* /wp-content/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;
}

However, if I manually enter in a web browser:

https://www.example.com/wp-content/themes/mytheme/functions.php

The file is still executed. What am i missing?

Also in my wp-config I have

/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
    define('ABSPATH', dirname(__FILE__) . '/');

Is this related and/or required?

  • if it's just about nginx configuration, try to ask on serverfault.com – mmm Sep 15 '16 at 20:31
  • could there also be a workaround in wp-config for this ? – JoaMika Sep 15 '16 at 20:32
3

Ok found the answer. You need to put this directive above the location:

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

The order apparently matters inside the nging conf file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.