Welcome to Centmin Mod Community
Register Now

Nginx nginx/drop.conf duplicates?

Discussion in 'Nginx, PHP-FPM & MariaDB MySQL' started by rdan, Jun 6, 2019.

  1. rdan

    rdan Well-Known Member

    4,547
    1,089
    113
    May 25, 2014
    Ratings:
    +1,590
    Local Time:
    8:29 PM
    Mainline
    10.2
    From this config:
    https://raw.githubusercontent.com/centminmod/centminmod/123.09beta01/config/nginx/drop.conf

    Code (Text):
    location ~ /\.git { access_log off; log_not_found off; deny all; }
    location ~ /\.gitignore { access_log off; log_not_found off; deny all; }
    


    are duplicates and already captured in:
    Code (Text):
    location ~ /\.          { access_log off; log_not_found off; deny all; }
    


    expires 30d is also redundant here:
    Code (Text):
    location = /favicon.ico { access_log off; log_not_found off; expires 30d; }
    

    As it's already in staticfiles.conf

    Please remove:
    Code (Text):
    location ~* ^/wp-content/updraft { deny all; }
    

    On this config and move it on specific Wordpress Include file (not sure what the filename is, wpsecure I guess).

    Thanks!
     
  2. eva2000

    eva2000 Administrator Staff Member

    40,276
    8,926
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +13,746
    Local Time:
    10:29 PM
    Nginx 1.15.x
    MariaDB 5.5/10.x
    it was added again in staticfiles.conf include as some folks disable or modify the wpsecure include file and that location block could be wiped and this expose updraft wordpress backups to public access. It's extra security precaution just in case and has no negative effects :)

    will correct the rest though they also have no harm in having them there
     
    • Like Like x 1
..