Security.conf & Wordpress.conf is blocking access to WP backend!

#103 Information

Details

*6523 access forbidden by rule *6586 access forbidden by rule *5 access forbidden by rule *1 access forbidden by rule

Description

# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy   "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

Is blocking access to the WP backend. When commenting out the security.conf from the sites .conf it started working.

Steps to reproduce

Create a new conf as above!

Expected behavior

To work and not block?

Screenshots

[MattIPv4]

# WordPress: deny scripts and styles concat
location ~* \/wp-admin\/load-(?:scripts|styles)\.php {
    deny all;
}

I’m guessing this is the rule at fault then – if you comment out just that rule, do things function as expected? (These rules pre-date me maintaining this project, but will dig through the history to figure out when/why this was added)

[MattIPv4]

Looks like this rule was originally added in https://github.com/digitalocean/nginxconfig.io/commit/62bd8f3e6be3d24d017f5d13365588717c7a4439

Researching the CVE, it seems this isn’t really a suggested fix for the issue, so I think the best solution may just be to remove this rule from the config completely.