php - Nginx location with deny doesn't work -

I have some problems with nginx configuration. I want to deny access to some folders and files, Did not even try to work Currently I am using the pasted configuration:

  server {80; Server_name .hostname; Keepalive_timeout 60; Root path / htdocs; Access_log path / log / access.log; Error_log path / log / error.log; Index index.php index.htm index.html; Place ~ \ .php $ {try_files $ uri = 404; Proxy_set_header Accepted-encoding ""; Include /etc/nginx/fastcgi_params; Fastcgi_pass php5-fpm-sock; Fastcgi_index index.php; Fastcgi_param SCRIPT_FILENAME path / htdocs $ fastcgi_script_name; } Location / {try_files $ uri $ uri / /index.php?q=$uri&$args; } #Unjection or Drop Placement Location ~ * wp-config.php {All reject; } Place ~ * wp-admin / contains {deny all; } Location ~ * wp-included /.* Php $ {reject all; } Place ~ / \. {Access_log off; Log_not_found off; Deny everyone; } Place ~ ~ $ {access_log off; Log_not_found off; Deny everyone; } #script to / upload location ~ / ^ / wp-content / uploads /.*. Stop $ {types {} default_type text / plain; (Html ​​| htm | shtml | php) }}  

But whenever I remove the location "/" and "php" (I was thinking that php is a more specific and runs before the rest of the part) problem now Anything above is also:

  # Some codes # Normal reject or drop space location ~ * wp-config.php {deny all; } Place ~ * wp-admin / contains {deny all; } Location ~ * wp-included /.* Php $ {reject all; } Place ~ / \. {Access_log off; Log_not_found off; Deny everyone; } Place ~ ~ $ {access_log off; Log_not_found off; Deny everyone; } #script to / upload location ~ / ^ / wp-content / uploads /.*. Stop $ {types {} default_type text / plain; (Html ​​| htm | shtml | php) } # Some code  

did not help but I still can access this file and folders through my browser.

Regex location was checked in order to be present before the match Are there. Therefore, in your case this is place ~ \ .php $ that prefers a php prefix with anything else to anything else. Keep that block at the end.