---
title: "Server Configuration: Nginx"
description: "## Why this is needed GOCSM writes PHP snippet files to `wp-content/uploads/gocsm/snippets/`. On Apache, a `.htaccess` file is automatically created in that directory to deny direct HTTP access. Nginx does not read `.htaccess` files, so the equivalent rule must be…"
url: "https://brightleafdigital.io/docs/server-configuration-nginx/"
updated: "2026-10-20"
category: GravityOps Code Snippet Manager / Advanced
---

# Server Configuration: Nginx

## Why this is needed

GOCSM writes PHP snippet files to `wp-content/uploads/gocsm/snippets/`. On Apache, a `.htaccess` file is automatically created in that directory to deny direct HTTP access. Nginx does not read `.htaccess` files, so the equivalent rule must be added to your server configuration manually.

Without this rule, a visitor who knows the file path could request a generated PHP snippet directly. The files contain `if (!defined('ABSPATH')) { exit; }` as a primary defence, but the Nginx rule is the correct defence-in-depth measure.

## The rule to add

Add the following `location` block inside your `server {}` block, before any `location /` block:

```
location ~* /wp-content/uploads/gocsm/snippets/ {
    deny all;
}
```

## Where to add it

The exact location depends on your server setup. Common locations:

- In your site's `.conf` file under `/etc/nginx/sites-available/`
- In a custom include file referenced by your main `nginx.conf`

After editing, test the configuration and reload Nginx:

```
nginx -t && systemctl reload nginx
```

## Verification

After adding the rule, test that direct access is blocked:

```
curl -I https://yoursite.com/wp-content/uploads/gocsm/snippets/<generated-file>.php
# Expected: HTTP/1.1 403 Forbidden
```

Replace `<generated-file>` with the name of a real file from `wp-content/uploads/gocsm/snippets/`.

## Apache users

Apache users do not need to do anything — GOCSM creates the `.htaccess` file automatically on activation if it does not already exist. If it was deleted, deactivate and reactivate the plugin to recreate it.