# Deny rules not working - raw php files being served!

**URL:** <https://www.ruby-forum.com/t/deny-rules-not-working-raw-php-files-being-served/227289>\
**Category:** NGINX\
**Created:** [March 10, 2013, 10:36am UTC](https://www.ruby-forum.com/t/deny-rules-not-working-raw-php-files-being-served/227289 "2013-03-10T10:36:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![edbloom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/3ab097/32.png) [@edbloom](https://www.ruby-forum.com/u/edbloom)\
**Post date:** [March 10, 2013, 10:36am UTC](https://www.ruby-forum.com/t/deny-rules-not-working-raw-php-files-being-served/227289/1 "2013-03-10T10:36:55Z")

</div>

Hi all,

I’m using a pretty simple WordPress nginx config that is documented on  
the  
WordPress codex.

[http://codex.wordpress.org/Nginx](http://codex.wordpress.org/Nginx)

All works fine except for 1 critical aspect.

The config uses a restrictions.conf which has some fairly simple rules  
for  
blocking unauthorized access to specific files and file patterns like  
the  
following:

# Deny all attempts to access hidden files such as .htaccess, .htpasswd,

.DS\_Store (Mac).

# Keep logging the requests to parse later (or to pass to firewall

utilities  
such as fail2ban)  
location ~ /. {  
deny all;  
}

What I’ve found is rather than actually denying requests, raw php files  
are  
being served up via nginx - which is very odd.

Any ideas why this would be happening?

Ed

Posted at Nginx Forum:

> **[Deny rules not working - raw php files being served!](https://forum.nginx.org/read.php?2,237177,237177#msg-237177)**
>
> Hi all, I'm using a pretty simple WordPress nginx config that is documented on the WordPress codex. http://codex.wordpress.org/Nginx All works fine except for 1 critical aspect. The config uses a restrictions.conf which has some fairly simp