`limit_req` and Wordpress-specific rules break `wp-login.php` - Githubissues

digitalocean / nginxconfig.io

⚙️ NGINX config generator on steroids 💉

https://do.co/nginxconfig

MIT License

27.66k stars 2.04k forks source link

`limit_req` and Wordpress-specific rules break `wp-login.php` #350

Closed jeremyj closed 2 years ago

jeremyj commented 2 years ago

Information

Details

Description

enabling limit_req with Wordpress-specific rules breaks wp-login.php

Steps to reproduce

Enable Wordpress rules in the Presets/PHP tab
Enable limit_req in the Global config/Security tab
Expected behavior

www.example.com/wp-login.php should return the wordpress admin page, instead the browser tries to download the wp-login.php file.

Adding a fastcgi_pass directive in nginxconfig.io/wordpress.conf fixes the problem:

## WordPress: throttle wp-login.php
location ~ /wp-login.php {
    limit_req zone=login burst=20 nodelay;
    include   nginxconfig.io/php_fastcgi.conf;
    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}

Screenshots