The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The message Access to the script '…' has been denied (see security.limit_extensions) is generated by PHP-FPM, even though you usually notice it while troubleshooting an Nginx request. PHP-FPM refuses to execute the requested primary script because its filename extension is not in the pool’s allowlist. Add only the required extension to security.limit_extensions, reload PHP-FPM, and then verify that Nginx is passing the correct script path.
If the message shows an empty script name—Access to the script '' has been denied—changing the extension list is unlikely to solve it. That form normally indicates a broken FastCGI path variable or routing rule, especially an incorrect SCRIPT_FILENAME.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the FastCGI error means
Nginx forwards a dynamic request to PHP-FPM through FastCGI. PHP-FPM chooses the file it is being asked to execute and checks that file’s extension against security.limit_extensions in the active pool configuration. If the extension is not allowed, PHP-FPM denies the request before running the file. The denial can appear to the client as an access-denied or 403-style response, while the detailed wording is written to the PHP-FPM or Nginx error log.
The check applies to the primary script, not to every file that the script might include. A normal PHP endpoint such as index.php succeeds when .php is allowed. A request that resolves to an .html, .xml, or another non-allowed extension is rejected unless that extension has explicitly been added to the pool allowlist.
#1 Best Overall
Recognize the two common message forms
| Log text | Most likely meaning | First place to inspect |
|---|---|---|
Access to the script 'path/file.ext' has been denied (see security.limit_extensions) |
The script path is present, but .ext is not permitted by the PHP-FPM pool. |
The pool’s security.limit_extensions value and the extension of the logged path. |
Access to the script '' has been denied |
PHP-FPM received no usable script filename. The problem is usually FastCGI parameter passing or Nginx routing. | SCRIPT_FILENAME, PATH_INFO, PATH_TRANSLATED, and the selected Nginx location. |
Why security.limit_extensions causes the denial
The directive is defined per PHP-FPM pool, so the value used by one virtual host may differ from another. The PHP manual documents a default of .php .phar. Older documentation and configurations often show only .php; the default changed from .php to .php .phar in the PHP 5.3.9/5.4.0RC2 timeframe. Always inspect the pool that actually serves the request instead of assuming the system-wide default.
The allowlist is a safety boundary. Restricting execution to PHP files reduces the chance that an attacker can place PHP code in a file with another extension and persuade the server to execute it. The PHP manual therefore recommends keeping the list as narrow as your application permits, ideally just .php when no other primary script type is required.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fastest safe fix: allow the required extension
1. Identify the pool and the exact file
- Read the PHP-FPM and Nginx error logs and copy the complete path shown in the denial. Note the extension at the end of that path. If the path is empty, skip to the path-diagnosis section instead of changing the allowlist.
- Find the pool configuration used by the site. It is commonly a file named
www.conf, but distributions place pool files in different directories and may use a site-specific filename. Search the PHP-FPM configuration forsecurity.limit_extensionsand confirm which pool contains it. - Check that the pool named by the Nginx upstream or service configuration is the same pool you are editing. Updating an unused pool has no effect on the request.
2. Edit the allowlist narrowly
Set the directive to a space-separated list of extensions, each including its leading dot. For example:
security.limit_extensions = .php .pharIf the application deliberately uses another extension as its primary executable script, add only that extension:
security.limit_extensions = .php .phar .phtmlThe second example is illustrative; use the extension your application genuinely requires. Do not add broad sets such as every text or template extension merely to make an error disappear. A request for a static document should remain static, and an upload directory should not become an execution directory.
3. Reload PHP-FPM and test a real request
Save the pool file, then reload the PHP-FPM service. The service name varies by distribution and PHP version, so use the name installed on your host, such as a versioned PHP-FPM unit. A reload applies pool configuration without requiring a full machine reboot. Request the same URL again and check the log. A successful change removes the extension-denied message; if the message now names a different file or remains empty, continue with path and routing checks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep a copy of the previous value until the request works. If the change causes unexpected scripts to execute, restore the narrower list immediately and investigate why the application selected that file.
Fix an empty script name or an incorrect script path
When the log contains two quotes with nothing between them, PHP-FPM was not given a usable primary script filename. The extension allowlist cannot match an empty value, so adding extensions is the wrong remedy.
Check SCRIPT_FILENAME
In the Nginx PHP location, the FastCGI parameters must resolve the request to a real file. A commonly used expression is:
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;Keep the existing fastcgi_pass target and include file for your installation, but verify that the resulting value points to the file on disk. For a request to /index.php under a document root of /srv/www/site, the value should resolve to /srv/www/site/index.php, not merely to a URL, a directory, or an empty string.
Recommended Free Tools
Rank #3
Pay attention to differences between root and alias. An alias changes how the URI maps to the filesystem, and a generic $document_root$fastcgi_script_name expression may no longer describe the actual file. In that case, build SCRIPT_FILENAME from the path used by the selected location and verify the result against the filesystem.
Remove conflicting path parameters
One reported cause of the empty-name variant was passing PATH_TRANSLATED and PATH_INFO values that did not match the real script. Temporarily remove those parameters from the PHP location, reload the relevant service, and retest. Add them back only when the application specifically needs them and their values are correct.
Do not “fix” a missing filename by enabling every path interpretation feature. A malformed path can make PHP-FPM execute a different file than the one the URL appears to target.
Inspect try_files and named locations
Routing can select a FastCGI location that does not receive the same parameters as the ordinary PHP handler. A documented case involved a try_files fallback into a named location; changing the configuration to a plain location ~ .php$ block resolved the denial. Compare the location that handles a direct .php request with the location reached after the fallback. They should provide the same script filename and FastCGI parameters.
Ensure that the PHP location is selected only for the extensions you intend to execute. A broad regular expression or an internal redirect from a static location can send an HTML or XML request to PHP-FPM, where the extension check then rejects it.
Rank #4
End-to-end troubleshooting procedure
- Capture the exact log line. Record the full script path, extension, virtual host, and timestamp. An empty path changes the diagnosis.
- Confirm the request is supposed to execute PHP. If the URL points to a static document, stop routing it to PHP-FPM. If the application intentionally executes a non-
.phpscript, document that requirement before changing the allowlist. - Locate the active pool. Find the pool file containing
security.limit_extensionsand verify that it serves this site. - Compare the extension. The extension in the logged filename must appear in the directive, including its leading dot. Do not assume that a setting in another pool applies.
- Make the smallest configuration change. Add one required extension, or restore a narrow list if an unnecessarily broad value was previously used.
- Reload PHP-FPM. A pool edit is not active until the service has reloaded the configuration. Check the service status or reload output for syntax errors.
- Validate Nginx configuration before reloading it. Run
nginx -t. Only after it reports a valid configuration should you reload Nginx. - Retest the original URL. Check both the HTTP result and the error log. A changed error usually identifies the next layer: a new path, permission, or application error is different from the original extension denial.
- Roll back if behavior broadens unexpectedly. Restore the prior allowlist or routing rule, reload PHP-FPM, and isolate the single request that requires the additional extension.
Configuration examples and what they imply
| Configuration choice | Use it when | Security and operational effect |
|---|---|---|
.php |
The application executes only conventional PHP scripts. | Narrowest commonly recommended policy. |
.php .phar |
You use PHAR files as primary scripts and accept the PHP-FPM default. | Allows PHAR execution in addition to PHP scripts; review whether your deployment needs it. |
.php .phar .phtml |
A known application component intentionally uses .phtml as its primary script. |
Permits that extra extension; protect upload and user-writable directories. |
| An unrestricted or false-like value | Not recommended as a routine fix. | Removes the extension boundary and can allow unintended files to be executed. |
Workarounds that need caution
Do not enable cgi.fix_pathinfo just to silence the message
Some troubleshooting posts suggest setting cgi.fix_pathinfo to 1. Sources discussing this error warn that doing so can open security holes. It changes how PHP interprets path information and can cause a request to be mapped to an unintended script when the URL and filesystem path do not line up. Correct the Nginx location and SCRIPT_FILENAME instead of enabling it as a blanket workaround.
Do not rely on an unrestricted security.limit_extensions value
A community bug comment mentions setting security.limit_extensions to FALSE as a way around the check. That is not official guidance. Treat it as an emergency diagnostic at most, verify behavior against the PHP version’s current documentation, and do not leave an unrestricted setting in production. The normal fix is an explicit, minimal extension list.
Permissions: necessary, but not the explanation established for this message
PHP-FPM must be able to read the resolved script, and the service account needs execute permission on each directory in the path. Those are independent filesystem requirements. However, the sources associated with this error focus on the extension rule and script-path parameters; they do not establish ordinary permissions as the root cause of the “see security.limit_extensions” message.
After correcting the extension and path, check ownership and mode only if the log changes to a file-read or permission error. Do not broaden permissions pre-emptively. SELinux was not addressed by the cited material, so label changes should be made only when a separate audit or denial record identifies SELinux as the cause.
How to prevent the error from returning
- Keep a per-site record of which PHP-FPM pool serves each Nginx virtual host.
- Use an explicit PHP location with a tested
SCRIPT_FILENAMErather than copying parameters into several unrelated locations. - Keep
security.limit_extensionsnarrow and review it whenever a plugin or deployment introduces a new script extension. - Prevent user-uploaded files from entering an executable location, regardless of their filename extension.
- Run
nginx -tbefore every Nginx reload and verify PHP-FPM reloads after pool edits. - Retain the exact error-log path in incident notes; it distinguishes an extension problem from an empty-path routing problem.
Quick decision guide
Use the following decision order to avoid applying a risky fix to the wrong layer:
- If the log names a real file with a non-allowed extension, add only that required extension to the correct pool, reload PHP-FPM, and retest.
- If the log names a real
.phpfile yet still denies access, confirm that the request is reaching the expected pool and that the pool configuration actually reloaded. - If the script name is empty, inspect
SCRIPT_FILENAME, remove conflictingPATH_TRANSLATED/PATH_INFOparameters, and reviewtry_filesfallbacks and named locations. - If the error changes to a filesystem or access-control error, investigate the new error on its own terms rather than widening the extension allowlist.
- If the request should serve a static file, remove the FastCGI route instead of permitting that static extension in PHP-FPM.
Bottom line
“Access to the script has been denied (see security.limit_extensions)” means PHP-FPM rejected the primary script’s extension. The durable fix is to identify the active pool, allow only the extension the application truly needs, reload PHP-FPM, and validate the Nginx configuration. An empty script name points elsewhere: repair the FastCGI path and routing variables, especially SCRIPT_FILENAME, rather than disabling PHP-FPM’s extension protection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
