You should block access in php file. For example: You define using defined ( 'ACCESS'... in any file you want direct access and put the line below to every php files: defined ( 'ACCESS' ) or die ( 'Restricted Access' ); Posted at Nginx Forum: https://forum.nginx.org/read.php?2,264663,264694#msg-264694