Nginx Directory Access Restriction

This document explains how to add protection for a directory on a server that runs NGINX.

NGINX does not read .htaccess files and any restrictions set with a .htaccess file will not apply. WHMCS uses a .htaccess file to protect the /vendor/ directory. This directory loses its protection on servers that runs NGINX. The below guide demonstrates how to restrict access to this directory.

Restricting Directory Access

For non-cPanel environments

The following steps require root access to the server running NGINX. If you do not have root, you will need to contact your web hosting provider or server administrator.

1. Log in to the web server.
2. Locate the Nginx configuration template (see "Locating the Nginx configuration file").
3. Add the deny directive (see "The Deny Directive") to the server block of your site's configuration.
4. Save your changes and restart Nginx.

For cPanel environments

You can use cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) to add protection to this directory.

cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy) only supports this process in cPanel & WHM version 84 and later. On a server that runs cPanel & WHM version 82 and earlier, use the non-cPanel environment steps.

To protect the directory, perform the following steps:

1. Select the /whmcs/vendor directory in cPanel's Directory Privacy interface (Home >> cPanel >> Files >> Directory Privacy).
2. Select the Password protect this directory checkbox.
3. Enter a display label in the Enter a name for the protected directory text box.
   This name only functions as a label for the directory. Do not confuse it with the directory’s actual name.
4. Click Save. A confirmation message will appear. Click Go Back to return to the directory's configuration.

The Deny Directive

server {
    location ^~ /vendor/ {
        deny all;
        return 403;
    }
    ...
}

You must add this location directive to the top of your server block configuration.

Locating the Nginx configuration file

Nginx has a very flexible configuration organization. Because of this, your configuration file may be in a number of different places.

cPanel & WHM

The following path is the default location for the Nginx configuration file on cPanel & WHM servers:

/etc/nginx/conf.d/users/<username>.conf

Debian & Ubuntu

The following path is the most common location:

/etc/nginx/sites-available/default

Administrators sometimes set up configuration files for each site individually. In this case, you can often find the configuration files for each domain in the /sites-available directory:

/etc/nginx/sites-available/example.com

None of the above

If the configuration file is not found in any of the above locations, at the command prompt, run the following command:

nginx -t

The output should display the current directory path to your server's Nginx configuration file. The output will should resemble the following example:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

To check if the Nginx configuration file contains any include directives, run the following command:

grep include /etc/nginx/nginx.conf

If the grep command does not return any output, then you can proceed with your changes to the configuration. If the grep command returns any includes, you must check each include file for the server directive. The following grep command output example displays an Nginx configuration file that contains includes:

include /etc/nginx/modules-enabled/*.conf;
include /etc/nginx/mime.types;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;

If none are found, the `server` block should be found in the config file found with `nginx -t`.

If included configuration files are found, it will be necessary to check each of the included files for the `server` directive.

Restarting Nginx

After making any configuration changes to Nginx, it is necessary to reload the Nginx config.

cPanel & WHM

Run the following command:

/usr/local/cpanel/scripts/restartsrv_nginx

Other Operating Systems

CentOS 6:

/etc/init.d/nginx reload

CentOS 7:

systemctl reload nginx.service

Debian/Ubuntu:

systemctl reload nginx