4

I am logging to debug file

wp-content/debug.log

but any user can download the file, if they put the url on their browser. How could I prevent access to this file using Nginx?

closed as off-topic by shea, Dave Romsey, bueltge, cjbj, TheDeadMedic Dec 15 '16 at 9:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

5

I've frequently seen this used in Apache 2.2:

<Files "debug.log">
    Order allow,deny
    Deny from all
</Files>

but that's deprecated in Apache 2.4:

The Allow, Deny, and Order directives, provided by mod_access_compat, are deprecated and will go away in a future version. You should avoid using them, and avoid outdated tutorials recommending their use.

I just tested with the Require directive in Apache 2.4:

Require all denied Access is denied unconditionally.

with:

<Files "debug.log">
   Require all denied
</Files>

and it seems to block it with 403 forbidden.

Note that it will block access from example.tld/debug.log, example.tld/wp-content/debug.log etc.

Update

I just noticed that you mentioned NginX, so I tested various location patterns and this seems to work:

location ~* /debug\.log$
{
    deny  all;
}

where the ~* modifier is for case insensitive regular expression matching.

Not the answer you're looking for? Browse other questions tagged or ask your own question.