In my server block in Nginx config, I have put:

location ~* /wp-content/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;

However, if I manually enter in a web browser:


The file is still executed. What am i missing?

Also in my wp-config I have

/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
    define('ABSPATH', dirname(__FILE__) . '/');

Is this related and/or required?

  • if it's just about nginx configuration, try to ask on serverfault.com
    – mmm
    Sep 15, 2016 at 20:31
  • could there also be a workaround in wp-config for this ?
    – JoaMika
    Sep 15, 2016 at 20:32

1 Answer 1


Ok found the answer. You need to put this directive above the location:

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;

The order apparently matters inside the nging conf file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.