Small Nginx note about the /bl-kernel rule in the docs

[kbeezie]

Small heads-up for anyone using Bludit on Nginx

I was going through my own Nginx configurations and noticed that one of the location lines wouldn’t actually work the way it looks like it should. I double-checked the Bludit documentation (here: https://docs.bludit.com/en/webservers/nginx) and it turns out the same line is in the official example, so I figured I’d mention it here in case it helps someone else.

The docs include this rule:

Code: Select all

location ^~ /bl-kernel/*.php { deny all; }

On Apache this kind of pattern works, but on Nginx the ^~ modifier is a literal prefix match. It does not treat * as a wildcard, so the rule only matches the exact string "/bl-kernel/*.php". Real files like "/bl-kernel/admin.php" or "/bl-kernel/helpers/text.php" don’t get caught by it.

If you want to actually block PHP files inside /bl-kernel/, the regex version works as intended:

Code: Select all

location ~* ^/bl-kernel/.*\.php$ { deny all; }

The other bl-content rules in the docs are fine — those directories don’t need patterns, just a straight prefix deny.

I understand this might be a low-priority fix for most installs, since Bludit’s PHP files already have internal checks at the top (for example: <?php defined('BLUDIT') or die('Bludit CMS.'); ). But having the correct Nginx rule prevents unnecessary PHP-FPM processes from spinning up on every attempted access, which saves resources and avoids pointless work on the server.

Not a big thing, just something I noticed while reviewing my own setup and thought it might be useful to share.