What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The PHP-FPM message Access to the script ... has been denied (see security.limit_extensions) has one of two causes: PHP-FPM received a script extension that the pool does not allow, or your web server built the wrong script path and sent a directory or PATH_INFO as the main script. For a normal PHP application, keep the pool restricted to .php, correct the FastCGI path mapping, reload the matching PHP-FPM pool, and test again.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the security.limit_extensions error means
security.limit_extensions is a PHP-FPM pool setting. It limits the extensions of the main script that FPM will parse. PHP documents the setting as protection against web-server configuration mistakes and recommends allowing only .php so other file types cannot be used to execute PHP code.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen a request arrives, PHP-FPM does not decide from the browser URL alone. It receives FastCGI variables, including the main script path. FPM examines that path and compares its extension with the pool’s allow-list. If the path ends in an extension that is not permitted, FPM logs the denial instead of running the file.
There are two important possibilities:
- Policy mismatch: the request really targets a PHP script with an extension that the active pool does not allow.
- Path-mapping error: the web server sends a directory, an incorrect document-root path, or the portion after a PHP filename as the script. In that case, changing the extension list hides the symptom while leaving routing broken.
The PHP manual documents .php .phar as the default value for the directive. The distributed pool template also contains a commented example, ;security.limit_extensions = .php .php3 .php4 .php5 .php7, and notes that an empty value allows every extension. That commented line is an illustrative template, not proof of the value active on your server. The uncommented setting in the pool that serves the request is authoritative.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Why the URL can look right while FPM sees the wrong file
A browser request such as /index.php does not itself identify the file PHP-FPM will parse. NGINX first converts the request into FastCGI parameters. The crucial parameter is SCRIPT_FILENAME, which PHP uses to determine the script name. If the configured document root is wrong, the resulting path may point to another site, a nonexistent location, or a directory even though the visible URL ends with .php.
The same issue appears with front-controller and PATH_INFO routing. In a URL such as /show.php/article/0001, only /show.php is the script. The remainder is request path information. Unless NGINX separates those portions, FPM can receive the whole string as the main script path and reject it under security.limit_extensions. This distinction is why the exact denied path is more useful than the URL alone.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start with the exact path in the denial
Read the PHP-FPM log and the web-server error log at the time of a failed request. Copy the complete path shown after “Access to the script.” Its shape usually tells you which branch to investigate.
| Path shown in the error | Most likely direction | First check |
|---|---|---|
A real file ending in .php |
The active pool, socket, or filesystem path may not be the one you think it is. | Identify the pool reached by fastcgi_pass, then inspect its uncommented security.limit_extensions and document root. |
| A file ending in another deliberate application extension | The application may intentionally execute that extension as PHP, or the request may be misrouted. | Confirm the application requirement before adding that extension; verify SCRIPT_FILENAME first. |
| A directory such as a document-root folder | FastCGI path construction or PATH_INFO handling is wrong. |
Inspect the PHP location block, path splitting, and existence check. |
The text after a PHP filename, such as /article/0001 |
The path-info portion has been treated as part of the script path. | Configure an explicit fastcgi_split_path_info rule and pass the two resulting variables separately. |
PHP Bug #68053 documents the same class of denial when PATH_INFO and script-path handling cause FPM to receive a directory-like path. That is why a directory in the log is a routing problem first, not a reason to permit more extensions.
Fix the configuration safely
1. Find the pool that actually serves the request
Locate the PHP-FPM pool configuration used by the socket or host named in your web server’s fastcgi_pass. The file is often named www.conf or stored under a package-specific pool.d directory, but layouts differ by operating system and PHP package.
Do not edit a similarly named pool that is idle or serves another virtual host. A configuration change has no effect if NGINX connects to a different socket, a different pool, or a separate PHP-FPM installation.
Recommended Free Tools
Pool scope matters when several sites share a server. One pool may allow only .php, while another has a legacy application requirement. Always associate the logged request with the exact upstream target in the virtual host configuration before comparing values between sites.
2. Inspect the uncommented extension policy
In the active pool, look for an uncommented setting such as:
security.limit_extensions = .phpFor a conventional PHP application, this narrow value is the safest choice. It lets FPM parse files whose main extension is .php and rejects arbitrary suffixes.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
If the application has a documented, intentional need to execute another extension as PHP, add only that extension and record why it is required. Do not copy the old template list merely because it appears in a comment. Likewise, do not set the value to an empty string to silence the message: the PHP source template says that an empty value permits all extensions, removing the protection entirely.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe manual’s documented default (.php .phar) and the older illustrative template line can differ between PHP versions and packages. Compare both with the active, package-installed pool file rather than assuming either one describes your host.
Do not infer the effective value from a commented line. Configuration comments can survive package upgrades and may show historical examples, whereas only the uncommented directive in the loaded pool controls the request. If the directive is absent, use the package’s active configuration and documented defaults as your reference, then keep the resulting policy as narrow as the application permits.
3. Make NGINX pass the real PHP filename
NGINX must set SCRIPT_FILENAME to the filesystem path of the PHP file that should run. Its FastCGI documentation states that this parameter is used by PHP to determine the script name.
A conventional location block has this essential shape:
Free tools Windows power users keep installed
One-click scans. No signup required.
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php-fpm.sock;
}Use the document root configured for this virtual host and the socket belonging to the pool you inspected. The socket path above is an example shape; your package may use a different filename or a TCP address. The important parts are that SCRIPT_FILENAME resolves to the actual file and fastcgi_pass reaches the intended pool.
A common failure is building the value from a URI variable or an incorrect root. That can turn a valid request for /index.php into a path that does not exist, points into another site, or includes extra URL text. FPM then evaluates the wrong path and reports an extension denial even though the visible URL appears to end in .php.
Check this mapping for each virtual host rather than assuming a global include is identical everywhere. Different roots, aliases, and upstream sockets can produce different effective paths. The path printed in the denial should be compared character-for-character with the file location you expect on disk.
4. Separate PATH_INFO when the application uses it
Some applications use URLs in which a PHP file is followed by path information, for example /show.php/article/0001. The PHP filename is /show.php; /article/0001 is PATH_INFO. NGINX’s documented pattern separates those portions before sending the request to FPM:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
location ~ ^(.+.php)(/.*)$ {
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass unix:/run/php/php-fpm.sock;
}The first capture becomes the script name and the second becomes PATH_INFO. Without that separation, the entire URI can be treated as the script path. If the denied path contains the text after .php, fix this mapping instead of expanding security.limit_extensions.
Whether you need a PATH_INFO block depends on the application’s routing design. Do not add overlapping regular-expression locations blindly; make sure the request is handled by the block that sets the variables shown above.
After changing the split, test a plain script request and a request with the application’s expected suffix. A successful plain request confirms the script mapping, while the PATH_INFO request confirms that the suffix is passed as request data rather than appended to the filename. Keep the extension policy unchanged during this test so a routing fix is not confused with a permission change.
5. Reject nonexistent scripts before FastCGI
Keep an existence check such as try_files $uri =404;, or the equivalent rule for your server configuration, before passing a request to FPM. This prevents a typo, directory, or upload path from being presented as the main PHP script.
The check must match the way your application routes requests. A front-controller application may intentionally send many URLs to one existing index.php; in that design, route the request to that known file rather than testing an arbitrary URI as though it were a filename. The security goal is the same: FPM should receive a real, intended script path.
An existence check is not a substitute for correct routing. It should operate after the server has determined which file is intended, and it should not be removed merely because one unusual URL fails. Removing it broadens the set of malformed paths that can reach FPM and makes the resulting log messages less specific.
6. Validate, reload, and test the matching service
- Run the PHP-FPM configuration-test command provided by your operating-system package. Correct every syntax error before reloading.
- Reload or restart the PHP-FPM service that owns the pool and socket used by NGINX. Reloading a different PHP version leaves the failing pool unchanged.
- Reload NGINX after changing its FastCGI location, using the validation procedure supplied by your package.
- Request the previously failing URL while watching both logs.
- Request a known-good, ordinary
.phpfile and confirm that it still executes. - For a PATH_INFO application, test both a plain script URL and a URL containing the documented path suffix.
If the old denial remains immediately after a successful reload, verify the process ID, service name, socket path, and pool file again. Persistent messages commonly indicate that a different FPM instance is still serving traffic.
Make one configuration change at a time when diagnosing the issue. If you change the pool policy, the NGINX location, and the virtual-host root simultaneously, a successful request will not show which correction mattered. Log timestamps and a fresh test request help distinguish a current failure from an old message that remains in the file.
How to choose the right extension policy
| Policy | When it fits | Security and compatibility effect |
|---|---|---|
.php |
Normal PHP applications where scripts use the standard suffix. | Narrowest execution scope and the policy PHP recommends. |
.php .phar |
An application deliberately runs PHP Archive files through FPM and the package’s documented default is used. | Broader than PHP-only; confirm that PHAR execution is required and that the files are controlled. |
| A small, explicit multi-extension list | A legacy application intentionally stores PHP code under additional, known suffixes. | Restores compatibility but increases the set of files that can execute PHP. Each extension should have a documented reason. |
| Empty value | Almost never appropriate for an internet-facing pool. | Allows all extensions according to the distributed pool template, eliminating the restriction rather than fixing routing. |
Compare any proposed change on four axes: whether it broadens executable file types, whether the application genuinely needs those types, whether SCRIPT_FILENAME and PATH_INFO are correct, and which pool/socket must be reloaded. A change that fixes one URL but sends arbitrary files to PHP is not a safe fix.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Compatibility should be demonstrated with a real request, not assumed from a filename convention. If a legacy extension is necessary, verify that the application actually stores executable PHP there and that the relevant files are controlled. Otherwise, keep the list at .php and correct the request path.
Common wrong fixes and why they fail
- Adding every suffix mentioned in an old pool comment: the comment is a template example, not a requirement. It expands PHP execution to files the application may never need.
- Allowing HTML, image, archive, or upload extensions: PHP recommends limiting FPM to PHP extensions to reduce the chance that an attacker can execute uploaded or otherwise unintended content as code.
- Setting an empty value: this permits all extensions. The warning disappears, but the security boundary disappears with it.
- Editing the wrong pool: NGINX may connect to another socket, another PHP version, or another virtual host’s pool.
- Changing only the pool policy when the log shows a directory: a directory-like script path indicates bad mapping or PATH_INFO handling. An expanded allow-list cannot make that path a valid script.
- Using an incorrect document root in
SCRIPT_FILENAME: the URI may look right while FPM receives a path outside the site or a path that does not exist. - Removing the existence check: this allows more malformed or unintended requests to reach FPM and makes diagnosis harder.
Troubleshooting by symptom
The denied path ends in .php
First confirm that the active pool allows .php. If it does, check that the file exists at the exact path logged, that the path matches the virtual host’s document root, and that NGINX connects to the pool whose configuration you inspected. A stale service, duplicate PHP installation, or wrong socket can make an apparently correct edit ineffective.
The denied path is a directory
Do not add an extension. Check the location block’s regular expression, try_files behavior, fastcgi_split_path_info, and SCRIPT_FILENAME. The request should resolve to an actual PHP file before FPM receives it.
The denied path includes text after .php
Treat it as a PATH_INFO problem. Separate the script and suffix, pass PATH_INFO explicitly, and test the application’s expected URL format. Bug #68053 is a documented example of this failure mode.
One site works while another fails
Compare the virtual hosts’ document roots, PHP locations, fastcgi_pass targets, and pool files. Per-site pools often have different policies, so a working site does not prove that the failing site uses the same FPM configuration.
The error returns after a configuration reload
Confirm that the configuration test examined the same file you edited, that the reload reached the correct PHP-FPM master process, and that NGINX is not still using a different socket or upstream. Watch fresh log timestamps while making one test request; this distinguishes an old message from a current failure.
Frequently asked questions
Does this error always mean the extension list is too short?
No. If the denied path is a directory or includes text after .php, the web server probably constructed the wrong script path. Correct SCRIPT_FILENAME and PATH_INFO handling before changing the allow-list.
Should I add .phar?
Only when the application intentionally runs PHP Archive files through FPM and the active package configuration uses that documented default. For ordinary applications, .php is the narrower policy.
Is an empty value a quick fix?
No. The distributed PHP-FPM pool template says an empty value allows all extensions. That removes the protection instead of correcting the request.
How do I know which pool to edit?
Follow the socket or host in NGINX’s fastcgi_pass directive, then locate the pool that owns that endpoint. Inspect its uncommented setting, not an unused pool or a commented example.
Do I need to reload both services?
Reload the PHP-FPM service that owns the serving pool. If you changed NGINX’s FastCGI location, validate and reload NGINX as well. Then test the failing URL and a known-good PHP file while watching fresh log entries.
When should I use managed PHP hosting or PHP-FPM support?
If you cannot identify the active pool, socket, or document-root mapping, managed PHP hosting or PHP-FPM administration support can help trace those components. The safe target remains the same: a real PHP script path and the narrowest intentional extension policy.
Final verification checklist
- The logged main script is a real file, not a directory or an unsplit PATH_INFO string.
- The active pool’s uncommented
security.limit_extensionsis the narrowest policy that meets the application’s documented needs. SCRIPT_FILENAMEresolves to the intended file under the correct document root.- PATH_INFO is split and passed separately when the application uses it.
- A nonexistent script is rejected before FastCGI processing.
- The configuration test passes, and the correct PHP-FPM pool and NGINX instance have been reloaded.
- Both the failing URL and a known-good PHP script work while the logs remain free of new denial messages.
The durable fix is therefore a correct path plus a deliberately narrow policy: make FPM receive the real PHP file, allow only the extensions the application intentionally executes, and leave the restriction in place after the request succeeds.
Frequently Asked Questions
What does the security.limit_extensions error actually indicate?
PHP-FPM rejected the main script path because its extension is outside the active pool’s allow-list, or because NGINX sent a directory or PATH_INFO text as the script. The denied path in the log distinguishes these cases.
Why does a request ending in .php still fail?
The visible URL is not the value FPM checks. An incorrect document root, URI-based filename, wrong socket, or duplicate PHP-FPM instance can make SCRIPT_FILENAME point somewhere else. Compare the logged path with the intended file and active pool.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCan I permit HTML or upload files by adding extensions?
That is unsafe unless the application intentionally executes those files as PHP. PHP recommends limiting FPM to .php to reduce the chance of unintended or uploaded content being executed.
What should I do when the denied path is a directory?
Do not broaden security.limit_extensions. Inspect try_files, the PHP location expression, fastcgi_split_path_info, and SCRIPT_FILENAME so FPM receives an actual PHP file.
How can I confirm that a reload affected the right service?
Trace fastcgi_pass to its socket or host, identify the owning pool and PHP-FPM master process, run the package’s configuration test, reload that service, and watch fresh log timestamps during a new request.
The Bottom Line
Fix the path before loosening the policy. Confirm the active pool, keep security.limit_extensions at .php unless a documented application requirement says otherwise, map SCRIPT_FILENAME to a real file, split PATH_INFO when needed, reject nonexistent scripts, and reload the PHP-FPM pool and NGINX instance that actually serve the request.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
