Apache and Nginx Environment prohibit directory run PHP script

If the upload directory is embedded in a PHP file, it can be executed remotely. For security reasons, we generally prohibit the running of PHP scripts on the upload directory.

Below Apache we can use the method to prevent running PHP script:

<Directory/wp-content/uploads>
Php_flag engine off
</Directory>

The Nginx method is as follows:

location/wp-content/uploads/{
Location ~. *\. (PHP)? $ {
Deny all;
}
}

For multiple catalogs, you can qualify together:

Location ~* ^/(uploads|images)/.*\. (PHP|PHP5) $
{
Deny all;
}

Lighthttpd

View sourceprint $HTTP [url] =~ "^/(forumdata|templates|upload|images)/" {

Fastcgi.server = ()

}

IIS is simpler, as shown in the following figure

"Apache Configuration Prohibit Access"

1. Prohibit access to certain files/directories
Add the Files option to control, such as not allowing access to the file of the. inc extension, and protecting the PHP class library:

<files ~ "\.inc$" >
Order Allow,deny
Deny from all
</Files>

Prohibit access to some of the specified directories: (You can use <DirectoryMatch> for a regular match)

<directory ~ "^/var/www/(. +/) *[0-9]{3}" >
Order Allow,deny
Deny from all
</Directory>

Prohibit by file matching, such as banning all access to pictures:

<filesmatch \. (? i:gif|jpe?g|png) $>
Order Allow,deny
Deny from all
</FilesMatch>

Prohibit access for URL-relative paths:

<Location/dir/>
Order Allow,deny
Deny from all
</Location>

Prohibit access to certain destinations for proxy (<ProxyMatch> can be used for regular matching), such as denying access to CNN.com through proxies:

<proxy http://piaoyun.cc/*>
Order Allow,deny
Deny from all
</Proxy>

2. Prohibit certain IP access/allow only certain IP access
If you want to control some illegal IP access, in the Directory option control:

<directory "/var/www/web/" >
Order Allow,deny
Allow from all
Deny from 10.0.0.1 #阻止一个IP
Deny from 192.168.0.0/24 #阻止一个IP段
</Directory>

Allow only certain IP access, for example, to allow internal or cooperative companies to access:

<directory "/var/www/web/" >
Order Deny,allow
Deny from all
All from example.com #允许某个域名
All from 10.0.0.1 #允许一个iP
All from 10.0.0.1 10.0.0.2 #允许多个iP
Allow from 10.1.0.0/255.255.0.0 #允许一个IP段, mask pair
All from 10.0.1 192.168 #允许一个IP段, not followed by
All from 192.168.0.0/24 #允许一个IP段, network number
</Directory>

Apache: Solution;

<directory "/home/domain/public_html" >
Options-indexes FollowSymLinks
AllowOverride All
<files ~ ". txt" >
Order Allow,deny
Deny from all
</Files>
</Directory>