1location = /favicon.ico {
2    log_not_found off;
3    access_log off;
4}
5
6location = /robots.txt {
7    allow all;
8    log_not_found off;
9    access_log off;
10}
11
12# Very rarely should these ever be accessed outside of your lan
13location ~* \.(txt|log)$ {
14    allow 192.168.0.0/16;
15    deny all;
16}
17
18location ~ \..*/.*\.php$ {
19    return 403;
20}
21
22location ~ ^/sites/.*/private/ {
23    return 403;
24}
25
26# Allow "Well-Known URIs" as per RFC 5785
27location ~* ^/.well-known/ {
28    allow all;
29}
30
31# Block access to "hidden" files and directories whose names begin with a
32# period. This includes directories used by version control systems such
33# as Subversion or Git to store control files.
34location ~ (^|/)\. {
35    return 403;
36}
37
38location / {
39    # try_files $uri @rewrite; # For Drupal <= 6
40    try_files $uri /index.php?$query_string; # For Drupal >= 7
41}
42
43location @rewrite {
44    rewrite ^/(.*)$ /index.php?q=$1;
45}
46
47# Don't allow direct access to PHP files in the vendor directory.
48location ~ /vendor/.*\.php$ {
49    deny all;
50    return 404;
51}
52
53# In Drupal 8, we must also match new paths where the '.php' appears in
54# the middle, such as update.php/selection. The rule we use is strict,
55# and only allows this pattern with the update.php front controller.
56# This allows legacy path aliases in the form of
57# blog/index.php/legacy-path to continue to route to Drupal nodes. If
58# you do not have any paths like that, then you might prefer to use a
59# laxer rule, such as:
60#   location ~ \.php(/|$) {
61# The laxer rule will continue to work if Drupal uses this new URL
62# pattern with front controllers other than update.php in a future
63# release.
64location ~ '\.php$|^/update.php' {
65    fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
66    # Security note: If you're running a version of PHP older than the
67    # latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.
68    # See http://serverfault.com/q/627903/94922 for details.
69    include fastcgi_params;
70    # Block httpoxy attacks. See https://httpoxy.org/.
71    fastcgi_param HTTP_PROXY "";
72    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
73    fastcgi_param PATH_INFO $fastcgi_path_info;
74    fastcgi_param QUERY_STRING $query_string;
75    fastcgi_intercept_errors on;
76    # PHP 5 socket location.
77    #fastcgi_pass 127.0.0.1:9000;
78    # PHP 7 socket location.
79    fastcgi_pass 127.0.0.1:9000;
80}
81
82# Fighting with Styles? This little gem is amazing.
83# location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
84location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
85    try_files $uri @rewrite;
86}
87
88# Handle private files through Drupal. Private file's path can come
89# with a language prefix.
90location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
91    try_files $uri /index.php?$query_string;
92}
93
94location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
95    expires max;
96    log_not_found off;
97}