title: Nginx location with deny doesn't work
body: <p>I've got some problems with nginx configuration. I want to deny access for some folders and files but nothing I tried worked. Currently I'm using configuration pasted below:</p>
  
  <pre><code>server {
  
      listen 80;
      server_name .hostname;
  
      keepalive_timeout 60;
  
      root path/htdocs;
  
      access_log path/logs/access.log;
      error_log path/logs/error.log;
  
      index index.php index.htm index.html;
  
      location ~ \.php$ {
          try_files $uri =404;
          proxy_set_header Accept-Encoding "";
          include /etc/nginx/fastcgi_params;
          fastcgi_pass  php5-fpm-sock;
          fastcgi_index index.php;
          fastcgi_param SCRIPT_FILENAME path/htdocs$fastcgi_script_name;
      }
  
      location / {
          try_files $uri $uri/ /index.php?q=$uri&amp;$args;
      }
  
      # Common deny or drop locations
      location ~* wp-config.php { deny all; }
      location ~* wp-admin/includes { deny all; }
      location ~* wp-includes/.*\.php$ { deny all; }
      location ~ /\. { access_log off; log_not_found off; deny all; }
      location ~ ~$ { access_log off; log_not_found off; deny all; }
  
       # Prevent scripts from running in /uploads
       location ~* ^/wp-content/uploads/.*.(html|htm|shtml|php)$ {
          types { }
          default_type text/plain;
       }
  }
  </code></pre>
  
  <p>But even when I delete location "/" and "php" one ( I was thinking that php one is more specific and runs before rest of sections ) problem is still up. Even something like that:</p>
  
  <pre><code># some code
  
  # Common deny or drop locations
  location ~* wp-config.php { deny all; }
  location ~* wp-admin/includes { deny all; }
  location ~* wp-includes/.*\.php$ { deny all; }
  location ~ /\. { access_log off; log_not_found off; deny all; }
  location ~ ~$ { access_log off; log_not_found off; deny all; }
  
   # Prevent scripts from running in /uploads
   location ~* ^/wp-content/uploads/.*.(html|htm|shtml|php)$ {
      types { }
      default_type text/plain;
   }
  
  # some code
  </code></pre>
  
  <p>didn't help. I still can get access to this files and folders through my browser.</p>