Latest revision as of 20:27, 26 April 2022

This document explains how to add protection for a directory on a server that runs NGINX.

NGINX does not read .htaccess files and any restrictions set with a .htaccess file will not apply. WHMCS uses a .htaccess file to protect the /vendor/ directory. This directory loses its protection on servers that runs NGINX. The below guide demonstrates how to restrict access to this directory.

Restricting Directory Access

For non-cPanel environments

1. Log in to the web server.
2. Locate the Nginx configuration template (see "Locating the Nginx configuration file").
3. Add the deny directive (see "The Deny Directive") to the server block of your site's configuration.
4. Save your changes and restart Nginx.

For cPanel environments

You can use cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) to add protection to this directory.

To protect the directory, perform the following steps:

1. Select the /whmcs/vendor directory in cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy).
2. Select the Password protect this directory checkbox.
3. Enter a display label in the Enter a name for the protected directory text box.
   This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.
4. Click Save. A confirmation message will appear. Click Go Back to return to the directory's configuration.

The Deny Directive

server {
    location ^~ /vendor/ {
        deny all;
        return 403;
    }
    ...
}

Locating the Nginx configuration file

Nginx has a very flexible configuration organization. Because of this, your configuration file may be in a number of different places.

cPanel & WHM

The following path is the default location for the Nginx configuration file on cPanel & WHM servers:

Debian & Ubuntu

The following path is the most common location:

Administrators sometimes set up configuration files for each site individually. In this case, you can often find the configuration files for each domain in the /sites-available directory:

None of the above

If the configuration file is not found in any of the above locations, at the command prompt, run the following command:

The output should display the current directory path to your server's Nginx configuration file. The output will should resemble the following example:

To check if the Nginx configuration file contains any include directives, run the following command:

If the grep command does not return any output, then you can proceed with your changes to the configuration. If the grep command returns any includes, you must check each include file for the server directive. The following grep command output example displays an Nginx configuration file that contains includes:

If none are found, the `server` block should be found in the config file found with `nginx -t`.

If included configuration files are found, it will be necessary to check each of the included files for the `server` directive.

Restarting Nginx

After making any configuration changes to Nginx, it is necessary to reload the Nginx config.

cPanel & WHM

Run the following command:

Other Operating Systems

CentOS 6:

CentOS 7:

Debian/Ubuntu: