# Nginx rules to deny php/perl execution

**URL:** <https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415>\
**Category:** NGINX\
**Created:** [November 20, 2010, 7:40pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415 "2010-11-20T19:40:26Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![okkezSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/85f322/32.png) [@okkezSS](https://www.ruby-forum.com/u/okkezSS)\
**Post date:** [November 20, 2010, 7:40pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/1 "2010-11-20T19:40:26Z")

</div>

Hello,

I have some directories (cache, static, etc) that denies execution of  
some files.  
In these directories I have a .htaccess file with this rule:

```
Order allow,deny
Deny from all

```

I would like to test nginx with php-fpm but I don’t know how to rewrite  
these rules in nginx  
Can someone help me?

Thanks

Posted at Nginx Forum:

> **[nginx rules to deny php/perl execution](https://forum.nginx.org/read.php?2,152089,152089#msg-152089)**
>
> Hello, I have some directories (cache, static, etc) that denies execution of some files. In these directories I have a .htaccess file with this rule: \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)"\> Order allow,deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 8:06pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/2 "2010-11-20T20:06:45Z")

</div>

On 20 Nov 2010 18h39 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I would like to test nginx with php-fpm but I don’t know how to  
> rewrite these rules in nginx Can someone help me?

Yes constrain exactly the locations where you pass the request  
upstream to FCGI or another server that handles PHP and/or Perl.

Precede those FCGI/upstream related directives with one (or several)  
that serve static files from those locations (static, cache, &c). That  
way if someone uploads a file that has a forged magic number (e.g.,  
php passing as jpeg) they’ll get the file served directly.

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 8:31pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/3 "2010-11-20T20:31:48Z")

</div>

Olá António,

that’s exactly what I need, since these directories have write  
permissions, but which rules should I have?

placing something like this will work, but the user can see/read the php  
content and I don’t want that

```auto
location ~ ^/(cache|static|etc)/ {
      root /var/www;
}
```

How do I deny execution/read access to those files  
(php|pl!php3|php4|php5)

Thanks

Nuno

Posted at Nginx Forum:

> **[Re: nginx rules to deny php/perl execution](https://forum.nginx.org/read.php?2,152089,152102#msg-152102)**
>
> Hello, I have some directories (cache, static, etc) that denies execution of some files. In these directories I have a .htaccess file with this rule: \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)"\> Order allow,deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 8:44pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/4 "2010-11-20T20:44:58Z")

</div>

On 20 Nov 2010 19h31 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

Olá Nuno,

> root /var/www;  
> }  
> [/code]
> 
> How do I deny execution/read access to those files  
> (php|pl!php3|php4|php5)

Try this:

location ~\* ^/(?:cache|static|etc)/._.(?:pl|php[345]_)$ {  
return 404; # or 403  
}

This directive should precede those that are “legal” in that location  
(static, cache, etc).

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 8:21pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/5 "2010-11-20T20:21:10Z")

</div>

On 20 Nov 2010 19h00 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > Deny from all
> > 
> > I would like to test nginx with php-fpm but I don’t know how to  
> > rewrite these rules in nginx Can someone help me?

Also add this as your _last_ location directive:

location ~\* .(?:php|pl)$ {  
return 404; # or 403 if you prefer.  
}

Note that you should have defined the locations where it’s “legal” to  
handle PHP and Perl before.

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 8:51pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/6 "2010-11-20T20:51:13Z")

</div>

Hello again,

Just test some rules and after some testing I have this:

```auto
  location ~ ^/(cache|static|etc)/ {
      root /var/www;
      if ( $request_filename ~* "^.+\.(php|pl|php3|php4|php5)$" ) {
        return 403;
      }
  }
```

Any advice?

Posted at Nginx Forum:

> **[Re: nginx rules to deny php/perl execution](https://forum.nginx.org/read.php?2,152089,152104#msg-152104)**
>
> Hello, I have some directories (cache, static, etc) that denies execution of some files. In these directories I have a .htaccess file with this rule: \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)"\> Order allow,deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 9:06pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/7 "2010-11-20T21:06:15Z")

</div>

Hi,

with your rule, if i try [http://localhost/cache/static.html](http://localhost/cache/static.html) (file  
exists) i get 404 error … even adding root /var/www.

Thanks

Posted at Nginx Forum:

> **[Re: nginx rules to deny php/perl execution](https://forum.nginx.org/read.php?2,152089,152107#msg-152107)**
>
> Hello, I have some directories (cache, static, etc) that denies execution of some files. In these directories I have a .htaccess file with this rule: \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)"\> Order allow,deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 9:11pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/8 "2010-11-20T21:11:54Z")

</div>

On 20 Nov 2010 19h50 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> }  
> I don’t see why you need the if. If the order is correct in the config  
> file then a simple location will do. Without the if.

Does the root directive needs to be in this context? Can it be moved  
to a server context or any other location above the current?

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 11:28pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/9 "2010-11-20T23:28:37Z")

</div>

Hello,

You rule it’s working now … It was on the wrong place.

Thanks 🙂

Posted at Nginx Forum:

> **[Re: nginx rules to deny php/perl execution](https://forum.nginx.org/read.php?2,152089,152134#msg-152134)**
>
> Hello, I have some directories (cache, static, etc) that denies execution of some files. In these directories I have a .htaccess file with this rule: \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)"\> Order allow,deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [November 20, 2010, 9:15pm UTC](https://www.ruby-forum.com/t/nginx-rules-to-deny-php-perl-execution/199415/10 "2010-11-20T21:15:03Z")

</div>

On 20 Nov 2010 20h05 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi,
> 
> with your rule, if i try [http://localhost/cache/static.html](http://localhost/cache/static.html) (file  
> exists) i get 404 error … even adding root /var/www.

Paste all the rules here. Only then can we see what’s going on.

— appa