Server Configuration: Nginx

Why this is needed #

GOCSM writes PHP snippet files to wp-content/uploads/gocsm/snippets/. On Apache, a .htaccess file is automatically created in that directory to deny direct HTTP access. Nginx does not read .htaccess files, so the equivalent rule must be added to your server configuration manually.

Without this rule, a visitor who knows the file path could request a generated PHP snippet directly. The files contain if (!defined('ABSPATH')) { exit; } as a primary defence, but the Nginx rule is the correct defence-in-depth measure.

The rule to add #

Add the following location block inside your server {} block, before any location / block:

location ~* /wp-content/uploads/gocsm/snippets/ {
    deny all;
}

Where to add it #

The exact location depends on your server setup. Common locations:

• In your site’s .conf file under /etc/nginx/sites-available/
• In a custom include file referenced by your main nginx.conf

After editing, test the configuration and reload Nginx:

nginx -t && systemctl reload nginx

Verification #

After adding the rule, test that direct access is blocked:

curl -I https://yoursite.com/wp-content/uploads/gocsm/snippets/<generated-file>.php
# Expected: HTTP/1.1 403 Forbidden

Replace <generated-file> with the name of a real file from wp-content/uploads/gocsm/snippets/.

Apache users #

Apache users do not need to do anything — GOCSM creates the .htaccess file automatically on activation if it does not already exist. If it was deleted, deactivate and reactivate the plugin to recreate it.