The error Access to the script '…' has been denied (see security.limit_extensions) is normally generated by PHP-FPM, even though it appears in the Nginx error log. PHP-FPM is refusing to execute the requested file because its extension is not in the pool’s allowlist, or because Nginx passed an empty or incorrect script path. Check the exact path in the log, correct security.limit_extensions only when necessary, verify SCRIPT_FILENAME and routing, then validate and reload the affected services.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the error means
Nginx forwards a PHP request to PHP-FPM through FastCGI. PHP-FPM then decides whether the target file is an executable primary script. Its pool setting, security.limit_extensions, limits which filename extensions may be executed. The PHP manual lists the default as .php .phar. A request for a different extension, such as .html or .xml, can therefore be rejected with an access-denied message even when the file exists and Nginx can read it.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe wording is easy to misread: the message is written to the Nginx error log, but the extension check is performed by PHP-FPM. Changing an Nginx filesystem permission or adding a broad Nginx allow rule will not fix an extension that PHP-FPM refuses to execute.
PHP’s default was changed from the older documented .php value to .php .phar in the PHP 5.3.9/5.4.0RC2 timeframe. Do not assume that a tutorial written for an older PHP release describes the pool you are running now.
Identify which variant you have
| Log message or symptom | Most likely area to inspect | First check |
|---|---|---|
Access to the script 'file.ext' has been denied (see security.limit_extensions) |
PHP-FPM extension allowlist | Check whether .ext appears in security.limit_extensions for the pool serving this site. |
Access to the script '' has been denied |
FastCGI path construction | Inspect SCRIPT_FILENAME, PATH_INFO, PATH_TRANSLATED, and the Nginx location that handles PHP. |
| The file has a permitted extension, but the error persists after editing the setting | Wrong pool, wrong configuration file, or routing | Confirm which PHP-FPM pool receives the request and whether a try_files fallback or named location changes the request. |
Record the complete path shown in the log before changing anything. The path tells you whether PHP-FPM is evaluating the file you expected, a fallback target, or no script at all.
Step 1: Confirm the exact script and extension
- Open the Nginx error log and locate the current message. Copy the complete value between the quotation marks after
script. - Check the filename extension exactly as PHP-FPM sees it. A request ending in
.phpis different from one ending in.html,.xml, or another suffix, even if the file contains PHP code. - Check that the path identifies a real file under the site’s document root. If the quoted script name is empty, skip directly to the path and routing checks below.
Do not broaden the allowlist merely because the URL looks like a PHP page. The setting applies to the primary script filename passed to PHP-FPM, not to the programming language you intended to use inside that file.
Recommended Free Tools
Step 2: Find the PHP-FPM pool that serves the site
security.limit_extensions is a PHP-FPM pool directive. It must be changed in the pool configuration that handles this Nginx virtual host, commonly a file named www.conf; the directory differs by distribution and PHP installation.
- Look for the pool section used by the FastCGI upstream in your Nginx configuration.
- Open that pool’s configuration and search for
security.limit_extensions. If it is absent, the compiled or package default may apply. - When several PHP versions or pools are installed, verify the socket or address in Nginx points to the pool you are editing. Editing an unused pool produces no change.
The value is a space-separated extension list. Include the leading dot for every extension. For example, a pool that genuinely must execute both PHP and another approved suffix could contain:
security.limit_extensions = .php .phar .extReplace .ext with the specific extension shown in your log. Do not copy this example literally unless that is the extension your application requires.
Step 3: Make the narrowest safe allowlist change
The PHP manual’s security guidance is to restrict execution to .php where possible. Every additional extension creates another filename pattern that PHP-FPM will treat as executable, so add only the suffix required by a known application design.
When the requested file really should be executable
Add that one extension to the pool’s existing list, preserving the existing entries. Save the file, then reload PHP-FPM using your operating system’s service manager. A restart is not inherently required by the setting; the important point is that the pool process rereads its configuration.
When the requested file should be static
Do not add .html, .xml, or another static suffix simply to silence the message. A static asset should be served by Nginx rather than sent to PHP-FPM. Review the Nginx locations and the application’s links so that the request reaches the intended static-file handler.
Rank #3
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
When the file extension is unexpected
An unexpected suffix can indicate a rewrite or fallback rule is forwarding the wrong target. Correct that routing instead of expanding the PHP-FPM allowlist. This keeps the extension control meaningful and avoids turning unrelated files into executable scripts.
Step 4: Verify SCRIPT_FILENAME
For a normal PHP location, Nginx must pass PHP-FPM the full filesystem path of the script. A commonly used form is:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;This line is an example of the expected relationship, not a guarantee that every site should use the same variables. The resulting value must resolve to the real file named in the request. Check for these problems:
- The document root in the server block is not the directory that contains the application.
- The script name is altered by a rewrite, so the concatenated path points somewhere else.
- The FastCGI include or location defines
SCRIPT_FILENAMEmore than once, with a later value overriding the intended one. - A symbolic link, chroot, or separate PHP-FPM filesystem view makes a path visible to Nginx but unavailable to the PHP-FPM process.
That last item is a deployment consideration: PHP-FPM must be able to read the resolved file from its own process environment. The cited error sources focus on the extension rule and path construction; they do not establish a particular permission or isolation failure as the cause of this message.
Rank #4
Step 5: Check the PHP location and try_files flow
Nginx routing can produce the same denial even when the allowlist is correct. A try_files fallback into a named location may pass an empty or altered script path to FastCGI. One documented case was resolved by replacing that flow with a conventional regular-expression PHP location.
What to inspect
- Find the
locationblock that handles PHP requests. - Trace every rewrite and
try_filesfallback leading to it. - Check whether the request enters a named location such as an internal fallback before FastCGI parameters are set.
- Confirm that the final
fastcgi_script_nameandSCRIPT_FILENAMErefer to the same existing file.
If a simple PHP location works while the named-location version produces an empty script name, keep the routing explicit rather than adding permissive PHP-FPM settings. Test one change at a time so you can identify which rule altered the path.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Step 6: Investigate an empty script name
The variant Access to the script '' has been denied means PHP-FPM received no usable primary script name. This is a path-passing problem, not evidence that an empty filename should be added to the extension list.
Inspect the FastCGI parameters for SCRIPT_FILENAME, PATH_INFO, and PATH_TRANSLATED. A reported fix for one configuration was removing PATH_TRANSLATED and PATH_INFO parameters that were interfering with the script path. Those parameters are not universally wrong, so treat removal as a targeted test after confirming that they are being set incorrectly in your configuration.
- Capture the request URL and the empty-script log entry.
- Review the PHP location and included FastCGI parameter file.
- Temporarily simplify the location so it passes a direct, verified
SCRIPT_FILENAME. - Retest the same URL and compare the new log entry.
- Restore any parameter that your application demonstrably needs, keeping only the values that produce the correct real path.
Step 7: Validate before and after reloading
- Save the PHP-FPM pool change, if one was required.
- Reload PHP-FPM through the service manager used by your operating system so the pool rereads its configuration.
- Before changing Nginx, run
nginx -t. Continue only if the syntax and configuration test succeeds. - Reload Nginx after a successful test when you changed its server block, location, rewrite, or FastCGI parameters.
- Request the same URL again and check both the HTTP result and the error log.
A successful reload does not prove the request is correct; it proves only that the configuration parses. The decisive test is whether the request now reaches the intended script without a new path or extension error.
Permissions: check them, but do not assume they explain this message
The PHP-FPM worker user and group still need read access to the target file and traversal access to its parent directories. Verify those basics if the error changes to a conventional file-access failure. However, the cited material does not confirm ordinary permissions as the root cause of the specific security.limit_extensions denial. Likewise, SELinux was not addressed by the cited sources, so do not label SELinux the cause without separate evidence from your system’s audit logs.
Workarounds that require caution
cgi.fix_pathinfo=1
Some troubleshooting guides suggest enabling cgi.fix_pathinfo. The cited sources warn that this can create security holes. Do not turn it on as a reflexive fix for an empty script name; correct the Nginx-to-FPM path first and evaluate the security implications of any change in your specific PHP version and application.
Disabling the extension check
A community bug comment mentions setting security.limit_extensions to FALSE as a workaround. That is not the PHP manual’s recommended configuration and is not an appropriate default. Prefer an explicit, minimal extension list. If an application vendor requires a broader policy, document the reason and review every file type that could become executable.
Common cases and the right response
| Case | Correct response | Avoid |
|---|---|---|
| A real script uses a non-default, approved extension | Add that single extension to the serving pool’s existing list, reload PHP-FPM, and retest. | Allowing every extension or disabling the check. |
| A static HTML or XML file is being sent to PHP-FPM | Fix the Nginx location or rewrite so Nginx serves the file directly. | Adding static extensions to the executable list. |
| The message names an empty script | Correct SCRIPT_FILENAME, routing, and conflicting path parameters. |
Changing permissions or extension settings without inspecting the path. |
| The setting change has no effect | Verify the active PHP-FPM pool, socket, configuration file, and reload status. | Editing a different PHP version’s unused pool. |
| The error changes after the fix | Use the new message to continue diagnosis; a changed error often identifies the next failing layer. | Undoing a valid narrow fix because the symptom moved. |
Final troubleshooting checklist
- Read the complete script path in the Nginx error log.
- Decide whether the requested suffix should be executable at all.
- Locate the PHP-FPM pool serving this virtual host.
- Check
security.limit_extensionsand keep it as narrow as practical. - Confirm that
SCRIPT_FILENAMEresolves to an existing file. - Trace
try_files, rewrites, named locations, and FastCGI includes. - For an empty script name, inspect
PATH_INFOandPATH_TRANSLATEDas well as the primary filename parameter. - Ensure PHP-FPM can read the resolved file.
- Reload PHP-FPM after pool changes.
- Run
nginx -tbefore reloading Nginx. - Retest the original URL and read the new log entry rather than relying only on the browser’s status page.
Why the narrow fix is the durable fix
This error is a safety boundary, not merely a nuisance. PHP-FPM is refusing to execute a filename outside its declared policy or is rejecting a request whose script identity was not passed correctly. Adding exactly the required extension repairs a legitimate application requirement while preserving the boundary for other files. Correcting the FastCGI path and routing repairs the underlying request when the filename is empty or wrong. Broad bypasses can make the immediate message disappear while leaving the server willing to execute files that were never intended to contain PHP code.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
