The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The PHP-FPM message Access to the script ... has been denied (see security.limit_extensions) means PHP-FPM received a main-script path whose extension is outside the pool’s permitted list. It can also mean the web server built the wrong path and sent a directory or the portion after .php as the script. For a normal PHP application, keep the pool limited to .php, correct the FastCGI path mapping, reload the matching PHP-FPM pool, and test both the failing URL and a known-good PHP file.
What the security.limit_extensions error means
PHP-FPM does not execute every file path that a web server sends to it. The pool directive security.limit_extensions limits the extensions of the main script FPM will parse. PHP documents this as protection against web-server configuration mistakes and recommends limiting FPM to .php so another file type cannot be used to execute PHP code.
The denial is therefore a safety check, not proof that PHP itself is broken. FPM compares the path it received with its allow-list. If the path ends in an unapproved suffix, FPM refuses it. The same message can appear when the path is not really a script at all: a bad FastCGI mapping may turn a directory, a nonexistent file, or a PATH_INFO segment into the apparent main script.
That distinction determines the fix. A deliberately legacy application that executes another extension as PHP may need a narrowly expanded allow-list. A conventional application usually needs the opposite: leave the allow-list narrow and make the web server pass the real .php file.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Why the denied path matters more than the wording
Start by copying the complete path from the PHP-FPM error log and the corresponding web-server log. Do not change configuration before checking what FPM actually rejected.
| Path shown in the denial | Most likely direction | First check |
|---|---|---|
A real file ending in .php |
The request reached FPM, but the wrong pool, socket, document root, or pool setting may be active. | Which pool serves the socket in fastcgi_pass, and what uncommented value that pool uses for security.limit_extensions. |
| A file ending in another deliberate application extension | The application may intentionally execute that extension as PHP, or the request may be routed incorrectly. | Whether the application actually requires that extension to be parsed as PHP before changing the allow-list. |
| A directory path | The web server probably mapped a directory or malformed URI as the main script. | SCRIPT_FILENAME, document-root variables, and an existence check before FastCGI. |
The text after .php, such as /article/0001 |
PATH_INFO handling or the regular expression used for the PHP location is likely wrong. | Whether the request is split into a script path and PATH_INFO. |
| A path outside the expected document root | The socket may be connected to a different pool, or a symlink and root variable may resolve differently than expected. | The active virtual-host configuration and the pool attached to the configured socket or host and port. |
PHP Bug #68053 documents the directory-like denial that can occur when PATH_INFO and script-path handling are combined incorrectly. Treat that pattern as a routing problem to investigate before weakening FPM’s extension policy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Understand the pool setting before editing it
Find the active pool
PHP-FPM settings are applied per pool. The pool is often named www and is commonly defined in a file such as www.conf or in a pool.d directory, but package layouts differ. The file you happen to open is not necessarily the pool serving the request.
- Read the web-server virtual host and identify the value in
fastcgi_pass. It may point to a Unix socket or to a TCP host and port. - Map that socket or endpoint to the PHP-FPM service and pool that own it.
- Open that pool’s active configuration and look for an uncommented
security.limit_extensionsline. A line beginning with a semicolon is a comment, not the running value. - Check the service’s included configuration files as well. A later include or a distribution-specific override can change the value you first find.
Use the narrowest allow-list
For a standard PHP site, use:
security.limit_extensions = .phpThe PHP manual documents .php .phar as the default for its documented configuration. The distributed PHP pool template, however, shows a commented illustrative line such as ;security.limit_extensions = .php .php3 .php4 .php5 .php7 and notes that an empty value allows all extensions. Those are not interchangeable promises about every operating-system package. The installed, uncommented pool configuration and the PHP version supplied by your package are authoritative for your host.
Do not set the value to empty just to silence the error. In the pool template, an empty value permits all extensions, which removes the protection the directive is intended to provide. Add another suffix only when you can identify a deliberate application requirement and understand the security consequence.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Correct NGINX’s PHP-to-FPM path mapping
NGINX must send the actual PHP file in the FastCGI parameter SCRIPT_FILENAME. NGINX’s documentation states that this parameter is used by PHP to determine the script name. If it is built from an incorrect root, an unsuitable URI variable, or a malformed split, FPM checks the wrong path and may reject it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Conventional requests with no PATH_INFO
A conventional PHP location has the following shape. Replace the socket with the endpoint used by the pool you inspected:
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php-fpm.sock;
}The regular expression matches a URI that ends in .php. The try_files check stops a nonexistent path from being handed to FPM. SCRIPT_FILENAME combines the active document root with the script name, while fastcgi_pass must point to the pool whose settings you just inspected.
Do not copy the socket path from an unrelated PHP version or another virtual host. A syntactically correct location can still use the wrong pool, producing apparently contradictory results when you edit a different pool file.
Requests that intentionally use PATH_INFO
A URL such as /show.php/article/0001 contains a script part and additional path information. NGINX documents fastcgi_split_path_info for separating them. A matching location can be written as:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
location ~ ^(.+.php)(/.*)$ {
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass unix:/run/php/php-fpm.sock;
}With this split, fastcgi_script_name represents /show.php and fastcgi_path_info represents /article/0001. FPM receives the PHP file as the main script and the trailing portion as PATH_INFO, rather than attempting to parse a directory-like combined path.
Use PATH_INFO only when the application expects it. If the application uses ordinary query strings or front-controller routing, a simpler PHP location and an application-level route may be safer. The important point is that the value sent as SCRIPT_FILENAME must remain the real file on disk.
Keep nonexistent and unsafe paths away from FPM
An existence check is a small but important boundary between NGINX and PHP-FPM. In the conventional example, try_files $uri =404; returns a 404 before FastCGI when the requested path does not exist. This prevents a typo, directory, upload path, or other URI from being presented as the main PHP script.
Use an equivalent platform rule if your configuration structure does not use that exact directive. Place the check in the request path that hands control to FastCGI, and verify that a separate rewrite or fallback location does not bypass it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
After adding or changing the check, test all of these cases:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- A known existing PHP file.
- A nonexistent path ending in
.php, which should not be executed. - A directory URL that previously appeared in the denial.
- A PATH_INFO URL if the application intentionally supports one.
- A static file and an upload path, confirming that neither is routed to PHP unexpectedly.
Validate, reload, and test the correct service
- Run the PHP-FPM configuration test command provided by your operating-system package. Fix every syntax or include error before reloading.
- Validate the NGINX configuration using the validation command supplied by your NGINX package. A valid PHP-FPM file does not make an invalid NGINX location safe to reload.
- Reload or restart the PHP-FPM service that owns the configured socket or TCP endpoint. Reload the web server after changing its virtual-host configuration.
- Request the URL that produced the denial while watching the PHP-FPM and web-server logs.
- Request a known-good
.phpfile through the same virtual host. This confirms that the socket, document root, and pool are aligned. - Repeat the test after clearing any application or proxy cache that could be serving an old route.
Service names, pool directories, socket names, and test commands vary by distribution and PHP package. Use the commands documented for the package installed on your server rather than assuming a version-specific service name.
Choose between changing the allow-list and fixing routing
| Option | Security scope | Compatibility | Operational effect | Use it when |
|---|---|---|---|---|
Keep .php only and correct mapping |
Narrowest; other file types cannot be parsed as PHP by that pool. | Works for conventional PHP applications. | Requires editing the active virtual host and reloading the matching services. | The denied path is a directory, PATH_INFO segment, nonexistent file, or an ordinary PHP script. |
| Add one explicitly required extension | Broader than PHP-only and increases the set of files that could execute PHP. | Supports a documented legacy or application-specific file type. | Requires editing and reloading the correct pool, then testing every affected route. | The application intentionally executes that suffix as PHP and routing is already correct. |
| Set an empty value | Broadest; the pool template says all extensions are allowed. | May hide the immediate denial but does not repair a bad path. | Removes a meaningful safety control across the pool. | Almost never; it should not be used as a generic troubleshooting shortcut. |
Compare any proposed fix on four questions: does it preserve the smallest security scope, does it support a deliberate application requirement, does SCRIPT_FILENAME identify a real file, and are you reloading the pool and socket that actually serve the request?
Common wrong fixes and why they fail
Adding arbitrary extensions
Adding .html, image suffixes, upload suffixes, or a long list copied from an old template may make the message disappear, but it allows more file types to execute PHP. PHP’s guidance is to allow only .php unless another extension is intentionally used for PHP code.
Editing the wrong pool
A server can run several PHP versions or pools. If NGINX points to one socket while you edit another pool’s www.conf, no request will change. Always start from fastcgi_pass and trace that endpoint to its owner.
Using the wrong document root
$document_root, a hard-coded path, and a symlink-resolved path do not always identify the same file. A root that is correct for static content can still be wrong for the PHP location. Log or otherwise verify the resulting SCRIPT_FILENAME and confirm that the file exists under that root.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Treating PATH_INFO as an extension problem
If the denied path contains a directory or everything after .php, expanding security.limit_extensions addresses the symptom, not the cause. Correct the split and pass the trailing text in PATH_INFO.
Removing the restriction
An empty security.limit_extensions value is not a neutral setting. The PHP pool template says it allows all extensions, so it can turn an uploaded or otherwise unintended file into executable PHP. Restore the narrow value after diagnosing the route.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPractical troubleshooting branches
The denied path is a normal PHP file
- Confirm the suffix is exactly
.php, including capitalization and any unexpected trailing text. - Inspect the uncommented setting in the pool serving the configured socket.
- Check that the request is not reaching a different PHP-FPM endpoint through another virtual host or proxy.
- Verify that
SCRIPT_FILENAMEresolves to the same PHP file under the active document root. - Validate and reload, then test a known-good PHP file through the same host.
The denied path is a directory
- Check whether the URI maps to an existing directory and whether an index rule or rewrite should handle it.
- Ensure the FastCGI location has an existence check before passing the request.
- Inspect the document-root variable and any symlink or alias directives.
- Retest the directory URL and a real PHP file separately.
The denied path includes text after .php
- Decide whether the application intentionally supports PATH_INFO.
- If it does, use an explicit
fastcgi_split_path_inforule and passPATH_INFOseparately. - If it does not, make the PHP location match only the script form and let the application or web server handle the route another way.
- Check the logs again to ensure FPM now receives the file path rather than the combined URI.
The change has no effect
- The edited file may be a commented template instead of the active pool configuration.
- The request may use a different socket, PHP version, or virtual host.
- The service may have rejected the reload because of a syntax error.
- An include file may override the value.
- A cache, proxy, or alternate upstream may be serving the request.
Security implications of broadening the list
The directive exists because the web server and PHP-FPM must agree about what constitutes a script. If a server permits users to upload or create files with another suffix and that suffix is accepted by FPM, an attacker who controls such a file may gain a path to PHP execution. The risk depends on the application’s upload controls, filesystem permissions, web-server routing, and pool isolation, but broadening the list removes one protective layer.
For that reason, treat every added suffix as a documented exception. Record why it is needed, which routes use it, and which pool receives those routes. Keep unrelated applications on a PHP-only pool when possible, and avoid changing a shared pool merely to accommodate one legacy endpoint.
When to use managed PHP support
If you do not control the web-server configuration, ask your managed PHP hosting provider or server administrator for the exact denied path, the pool and socket serving it, and the effective SCRIPT_FILENAME. Provide the URL, timestamp, PHP version, and relevant log lines. A support team can then determine whether the fix belongs in the pool policy, the virtual-host mapping, or the application’s PATH_INFO rules without opening all extensions globally.
For self-managed servers, document the final pool value and FastCGI mapping alongside the deployment configuration. Future PHP package upgrades can replace templates, add pools, or change socket names; a written mapping makes it easier to verify that the intended restriction remains active.
Quick Recap
Reference points from the official documentation
- PHP’s configuration documentation defines
security.limit_extensionsas limiting the extensions of the main script FPM will parse and recommends limiting FPM to.phpto prevent other extensions from executing PHP code. - The distributed PHP pool template demonstrates the directive with a commented list of historical PHP suffixes and states that an empty value allows all extensions. It is an example, not a substitute for inspecting the active package configuration.
- NGINX’s FastCGI documentation identifies
SCRIPT_FILENAMEas the parameter PHP uses to determine the script name and documents splitting a script path from PATH_INFO. - PHP Bug #68053 records the directory-like denial associated with PATH_INFO and script-path handling, reinforcing the need to inspect routing before widening the extension policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
