Nginx File Protection Rule Generator

Block private folders under the public root and serve files only through an authenticated router.

Nginx File Protection Rule Generator

A starter deny rule for separating public pages from private file folders.

Blocked folders Private router

# Direct file access block
location ~ ^/(private_uploads|logs|data)/ {
    return 404;
}

# Authenticated media router
location = /media.php {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}

Related articles

HTTP Responses to Check After Applying

This example requests the default data folder on the current domain and compares it with a normal public page.

Direct private-data request

Example: curl -I https://sameos.uk/data/targets.txt
Result: HTTP 404

The response does not disclose whether the underlying file exists.

Public-home control request

Example: curl -I https://sameos.uk/
Result: HTTP 200

The control confirms that blocking is scoped to the designated private path rather than the whole site.