I want to block access for a specific php file for all domains. I know that I can use

location = /xmlrpc.php {
deny all;
access_log off;
log_not_found off;
return 444;

in the server block, for example, however I want to set that for all domains, like a pre-filter.

The other possible idea is add a include in every domain config and point to the same file to load this rule. But I think this is possible in nginx, as is possible in Apache.

1 Answer 1


A straightforward approach is using include indeed. This won't require any additions to your NGINX.

Otherwise, you might be looking for a WAF module, there are 3 prominent nowadays - ngx_waf, Modsecurity, and naxsi. Configuration for each is different but I think they'll allow you to do this in "one place" as opposed to using includes.

If that's an option, you can make your own NGINX module. But probably an overkill... but still an idea, as in:

http {
    # applied to all websites
    bad_files xmlrpc.php .env;
    bad_files_status 444;

Such a module could be relatively easy to complete for someone familiar with C.

I'd go with the include way. Repeated include in every server block is not an issue, especially if you use configuration tools like ansible to template your NGINX configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .