Install Drupal 10.1.1 on Debian 12 server + PHP8.2 , SSL , MARIADB , NGINX
Support the channel : (any donation are appreciated) , god bless.
https://buymeacoffee.com/itwizard0
https://paypal.me/ITwizard0?country.x...
sudo nano /etc/nginx/snippets/denystuff.conf
Don't log favicon
location = /favicon.ico {
log_not_found off;
access_log off;
}
Don't log robots
location = /robots.txt {
access_log off;
log_not_found off;
}
Deny yml, twig, markdown, init file access
location ~* /(.*)\.(?:markdown|md|twig|yaml|yml|ht|htaccess|ini)$ {
deny all;
access_log off;
log_not_found off;
}
Allow access to certbot directory in order to obtain TLS certificate
location ~ /.well-known/acme-challenge {
allow all;
}
Deny all attempts to access hidden files/folders such as .htaccess, .htpasswd, .DS_Store (Mac), etc...
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
Deny all grunt, composer files
location ~* (Gruntfile|package|composer)\.(js|json)$ {
deny all;
access_log off;
log_not_found off;
}
Deny access to any files with a .php extension in the uploads directory
location ~* /(?:uploads|files)/.*\.php$ {
deny all;
}
A long browser cache lifetime can speed up repeat visits to your page
location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
access_log off;
log_not_found off;
expires 360d;
}
Very rarely should these ever be accessed outside of your lan
location ~* \.(txt|log)$ {
allow 192.168.0.0/16;
deny all;
}
location ~ \..*/.*\.php$ {
return 403;
}
location ~ ^/sites/.*/private/ {
return 403;
}
Allow "Well-Known URIs" as per RFC 5785
location ~* ^/.well-known/ {
allow all;
}
Block access to "hidden" files and directories whose names begin with a
period. This includes directories used by version control systems such
as Subversion or Git to store control files.
location ~ (^|/)\. {
return 403;
}
Don't allow direct access to PHP files in the vendor directory.
location ~ /vendor/.*\.php$ {
deny all;
return 404;
}