PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Separate the directory request from file requests. Protect the slash-terminated directory URI with auth_basic, leave autoindex off, and use a more-specific file location with auth_basic off; only when those known files are meant to be public. Test the directory, its index, the no-slash form, nested paths, missing files, and inherited authentication independently.
Start with the access policy, not the directives
“Restrict the directory but keep file access” can describe several different policies. Decide which one you need before writing a location block.
Policy A: protect the directory endpoint, publish known files
A request for /downloads/ must authenticate, while a request such as /downloads/manual.pdf is served without credentials. This is the pattern used in the example below. It is useful when users may follow a supplied file link but should not browse the directory.
Policy B: protect the directory and every file
Authentication remains on the broader directory location. Do not add auth_basic off; to a child location, because that directive cancels authentication inherited from a broader block.
#1 Best Overall
Policy C: allow only selected files
Use exact locations for the files that are intentionally public and deny or authenticate the remaining directory paths. This is safer than making an entire tree public when the directory contains mixed-content files.
Policy D: restrict by network address
Use allow and deny when access depends on the client network. Basic Authentication and IP checks can be combined with satisfy all or satisfy any, depending on whether every check or just one successful check should be sufficient.
How NGINX decides which location handles a request
The configuration works because NGINX chooses a location based on the URI before it serves the file. A more-specific match can therefore have a different authentication policy from a broader prefix.
| Location form | Example | Typical use here |
|---|---|---|
| Exact match | location = /downloads/ |
Handle only the slash-terminated directory endpoint. |
| Prefix with regular-expression protection | location ^~ /downloads/ |
Serve files and nested paths under the directory without allowing a later regular-expression location to unexpectedly take over. |
| Plain prefix | location /downloads/ |
Apply one policy to the whole subtree when separate directory and file behavior is unnecessary. |
| Exact file match | location = /downloads/manual.pdf |
Give one named file a policy that differs from the rest of the tree. |
The exact match for /downloads/ wins for that one URI. A request for /downloads/manual.pdf does not match the exact directory block, so it falls through to the ^~ /downloads/ prefix. This is the key to protecting the directory endpoint while serving a known file directly.
Why ^~ can matter
The ^~ modifier tells NGINX to use the longest matching prefix without then checking regular-expression locations. It is useful when another server-wide regular expression could otherwise capture a download URI and apply a different root, authentication rule, or handler. It is not an access-control directive by itself; it only makes location selection more predictable.
Keep exact locations narrow. An exact match for /downloads/ does not cover /downloads, /downloads/index.html, or a nested directory. Conversely, an exact file match protects only that exact URI, so a renamed file or alternate spelling needs its own policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Minimal configuration: protected listing endpoint, public known files
The following server block maps URLs beneath / to /srv/www. It requires credentials for the directory URI, keeps generated listings disabled, and serves existing files under the directory without inherited Basic Authentication.
server {
root /srv/www;
# Directory endpoint: require credentials and do not expose a listing.
location = /downloads/ {
auth_basic "Restricted directory";
auth_basic_user_file /etc/nginx/.htpasswd;
autoindex off;
try_files $uri $uri/ =404;
}
# Direct files: public only because this policy intentionally cancels inherited auth.
location ^~ /downloads/ {
auth_basic off;
try_files $uri =404;
}
}With this arrangement, the expected behavior is:
| Request | Selected behavior | Expected result |
|---|---|---|
/downloads/ |
Exact directory location | Authentication challenge; no generated listing. |
/downloads/manual.pdf |
Directory prefix location | File is returned if it exists, without inherited Basic Authentication. |
/downloads/missing.pdf |
Directory prefix location | 404 from try_files. |
/downloads/subdir/file.zip |
Directory prefix location | Served when the mapped file exists, subject to the same public-file policy. |
auth_basic limits access by validating a user name and password through HTTP Basic Authentication. It is valid in the http, server, location, and limit_except contexts. The auth_basic off; line is deliberate: it disables authentication inherited from a broader server or location block. Remove that line when files must remain protected.
Choose the correct variation for your policy
Protect every file under the directory
Use one prefix location and keep authentication enabled. This is simpler and avoids an accidental public-file exception.
location ^~ /downloads/ {
auth_basic "Private downloads";
auth_basic_user_file /etc/nginx/.htpasswd;
autoindex off;
try_files $uri $uri/ =404;
}Because the same block handles the slash URI, files, and nested paths, every existing resource in the subtree receives the same credential challenge. Confirm that this is what you want before replacing a split configuration.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Make only named files public
When a directory contains both public documents and private material, use exact file locations rather than opening the whole prefix.
location ^~ /downloads/ {
auth_basic "Private downloads";
auth_basic_user_file /etc/nginx/.htpasswd;
autoindex off;
try_files $uri $uri/ =404;
}
location = /downloads/public-guide.pdf {
auth_basic off;
try_files $uri =404;
}The exact file location is selected only for /downloads/public-guide.pdf. Other files continue to use the protected prefix. Add one exact location for each deliberately public URI, and review the list when files are added or renamed.
Combine Basic Authentication with IP restrictions
IP rules and authentication are separate access checks. A configuration using satisfy all requires both a permitted address and valid credentials; satisfy any allows one successful check.
location ^~ /downloads/ {
allow 192.0.2.0/24;
deny all;
auth_basic "Staff downloads";
auth_basic_user_file /etc/nginx/.htpasswd;
satisfy all;
try_files $uri $uri/ =404;
}Do not assume an allow or deny rule in a parent automatically combines with a child rule. These directives are inherited only when the current level defines neither. If a child location introduces its own access rules, review the complete effective policy there.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDirectory listings and index files are different requests
What autoindex controls
The autoindex module processes requests ending in a slash and generates a directory listing when enabled. Its default is off, so a directory does not become browsable merely because files exist underneath it. Turning listings off does not prevent NGINX from serving a known file whose URL is requested directly.
Use autoindex on; only when a listing is an intentional feature. If you enable it in a protected directory location, verify that the authentication challenge occurs before the listing is displayed.
Why index.html can appear to bypass the directory rule
The index module handles a slash-ended request and may internally redirect to an index file. For example, /downloads/ can cause an internal request for /downloads/index.html. That second URI is then matched again, potentially by the broader file location where authentication has been disabled.
If the index must be protected, give it an explicit policy:
location = /downloads/index.html {
auth_basic "Restricted directory";
auth_basic_user_file /etc/nginx/.htpasswd;
try_files $uri =404;
}If the index should not be served, set an appropriate index policy or return an intentional error for that exact URI. Test the slash request and the index URI separately; a successful direct-file request does not prove that the index follows the same access rules.
Handle the trailing-slash form explicitly
/downloads and /downloads/ are different URIs. NGINX commonly redirects a directory request without its trailing slash so relative links work correctly, but the redirect and the subsequent slash-ended request are separate steps. Check both in a client and decide whether the redirect itself should be public, authenticated, or replaced with another response.
If your policy requires a dedicated rule for the no-slash URI, add an exact location and choose the response deliberately. For example, you may redirect it to the canonical slash form, or return a status that does not reveal the directory’s presence. Do not assume that a rule written only for /downloads/ also governs /downloads.
Nested directories, encoded paths, and alternate names
A prefix such as ^~ /downloads/ also matches nested paths, including /downloads/manuals/2026/guide.pdf. If nested directories should not be browsable, keep autoindex off effective for the prefix and test slash-ended nested requests. If a nested directory needs a different policy, add a more-specific location and document why it differs.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Decide how the application should treat percent-encoded characters, repeated slashes, and dot-segment forms such as ../. NGINX normalizes the request URI during processing, but upstream applications, caches, and filesystem checks can still expose mismatches if they canonicalize paths differently. Probe representative encoded names and reject ambiguous forms when they could identify a sensitive file.
Make sure the URL maps to the intended file
try_files checks whether a file or directory exists and internally redirects when it finds one. The filesystem path it checks depends on whether the location uses root or alias.
| Directive | Mapping behavior | Example implication |
|---|---|---|
root /srv/www; |
Appends the request URI to the root path. | /downloads/manual.pdf maps beneath /srv/www/downloads/manual.pdf. |
alias /srv/files/; |
Replaces the matching location prefix with the alias path. | A location for /downloads/ can map to a different filesystem directory than the URL suggests. |
When changing from root to alias, re-check every try_files result, because a syntactically valid configuration can still point at the wrong directory. Confirm that the NGINX worker account can traverse the parent directories and read the intended files.
Be especially careful when combining alias with a prefix location. The trailing slash on both the location and alias path should reflect the intended replacement, and the resulting path should be verified with a known file and a missing file. Never rely on the URL name alone to infer where a file is stored.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect files that should never be directly downloadable
Directory access rules are not a substitute for file-level protection. Keep password databases, private keys, deployment manifests, source archives, backups, and other operational files outside the public tree when possible. Where they must remain beneath it, add explicit deny or authentication locations and enforce restrictive filesystem permissions.
The password file named by auth_basic_user_file must be readable by the NGINX worker. If it is missing or unreadable, authentication requests fail even though the location syntax is correct. At the same time, do not make that file world-readable merely to fix a permission error; grant the worker the minimum access needed.
Understand the response you should expect
A protected Basic Authentication resource normally returns 401 Unauthorized together with a WWW-Authenticate challenge when credentials are absent or invalid. An IP rule that rejects a client commonly produces 403 Forbidden. A missing path handled by try_files ... =404 should return 404 Not Found, without accidentally falling through to an application route that exposes unrelated content.
A no-slash directory request may first return a redirect, often 301 or 302, before the client requests the slash form. Record both responses when troubleshooting. Also check whether an error-page directive internally redirects a failed request into another location; an error handler can inherit or override authentication just like an index file can.
Recommended Free Tools
Apply and validate the configuration safely
- Identify the effective parent policy. Check the enclosing
http,server, and location blocks for inheritedauth_basic,allow,deny,root,alias, andindexdirectives. - Choose canonical URIs. Decide how
/downloads,/downloads/, nested directories, and encoded or dot-segment paths should behave. - Write the narrowest matching locations. Use an exact match for the directory endpoint or a named public file, and a prefix for the remaining subtree. Add
auth_basic off;only where public access is intentional. - Protect sensitive names. Add explicit deny or authentication rules for password files, keys, manifests, archives, and any other file that must not be downloadable.
- Check the syntax. Run
nginx -t. Do not reload a configuration that fails this test. - Reload through the host’s service manager. Use the reload operation provided by the system that runs NGINX, so existing connections can be handled according to that system’s normal process.
- Probe each policy branch. Request the directory, no-slash URI, known file, index file, nested file, missing file, and a sensitive filename. Record status codes and response headers.
- Check authentication headers. A protected Basic Authentication response should include a
WWW-Authenticatechallenge. A public file location should not unexpectedly issue that challenge. - Repeat tests after changes. Recheck a public-file allowlist whenever files are renamed, a new location is added, or a parent server block changes. Location inheritance means an unrelated-looking edit can change the effective policy.
Troubleshoot the common failure modes
| Symptom | Likely cause | Correction |
|---|---|---|
| The file still prompts for credentials. | Authentication is inherited from a broader block, or the request is being handled by a different location. | Confirm the selected location and add auth_basic off; only in the intended public-file block. |
| The directory listing is visible. | autoindex on; is enabled at this or an inherited level, or a different location handles the slash URI. |
Set autoindex off; in the directory location and verify the exact URI match. |
index.html is public when the directory is protected. |
The index caused an internal redirect to a file location where authentication is disabled. | Add an explicit index-file location or change the index policy. |
/downloads behaves differently from /downloads/. |
They are separate URI requests and may involve a redirect. | Test both forms and define an exact no-slash policy if necessary. |
A valid file returns 404. |
root or alias maps the URI to an unexpected filesystem path, or the worker cannot traverse the path. |
Resolve the resulting path, verify permissions, and retest try_files. |
| Authentication fails for every user. | The password file is absent or unreadable by the NGINX worker. | Check the file path and permissions without making the credentials file publicly readable. |
| An IP exception has no effect. | A child location changed the inherited allow/deny policy, or satisfy does not match the intended combination. |
Review access directives at the exact location handling the request and choose satisfy all or satisfy any explicitly. |
| A redirect or custom error appears to bypass protection. | An internal redirect selected an error, index, or fallback location with a different policy. | Trace the final URI and add an explicit rule for the internally generated request. |
A practical decision checklist
- Is the directory endpoint itself supposed to challenge, redirect, return an error, or show a listing?
- Are direct files public, authenticated, IP-limited, or restricted to an explicit allowlist?
- Does any parent block add Basic Authentication or IP controls that the file location will inherit?
- Could an index request internally redirect into a location with a different policy?
- Do
rootoraliasmap the URL to the intended filesystem directory? - Are
/downloads,/downloads/, nested paths, missing files, and sensitive filenames covered? - Has
nginx -tpassed before reload, and have response statuses andWWW-Authenticateheaders been checked afterward?
Further reference
For a deeper treatment of access restriction directives, location processing, and internal locations, the Nginx HTTP Server, 3rd Edition technical book is a useful reference. Check the current edition and listing details when purchasing, since availability and pricing can change.
Frequently Asked Questions
How do I protect only the NGINX directory listing while allowing direct file links?
Use an exact location for the slash-ended directory, such as location = /downloads/, and require authentication there. Add a more-specific prefix or exact-file location for approved files. Set auth_basic off; in that file location only if those files are intentionally public.
Best Value
Does autoindex off; block direct downloads?
No. autoindex controls generated listings for slash-ended directory requests. A known file can still be served directly when its URI maps to an existing file and the selected location allows access.
Why does index.html bypass my protected directory?
A slash-ended request can be internally redirected to the index URI. That URI is matched again and may enter a public file location. Add an explicit location for the index file or change the index setting, then test both the directory URI and the index URI.
Should I use auth_basic off; in every file location?
Only when direct files are meant to be public and authentication is inherited from a broader block. If every file must be protected, leave authentication enabled on the prefix and do not cancel it in a child location.
What is the difference between /downloads and /downloads/?
They are separate URIs. The no-slash form may redirect to the slash form, but the redirect and the subsequent request can be handled differently. Test both and add an exact no-slash rule when the distinction matters.
Can I protect a directory by IP address and still require a password?
Yes. Combine allow/deny with auth_basic. Use satisfy all when both checks must succeed, or satisfy any when either an approved address or valid credentials should grant access.
Why does a real file return 404 after I change to alias?
root appends the URI to its path, whereas alias replaces the matching location prefix. The resulting filesystem path may not be the one you expect. Verify the mapping, trailing slashes, worker permissions, and the try_files result.
What should I test before reloading NGINX?
Run nginx -t first. After a successful reload, request the no-slash and slash directory forms, a known public or protected file, the index, a nested file, a missing file, and sensitive filenames. Check status codes and whether protected responses include WWW-Authenticate.
The Bottom Line
Use location scope to separate the directory endpoint from file requests. Protect /downloads/ with Basic Authentication, keep autoindex off, and expose only the files your policy allows. Cancel inherited authentication with auth_basic off; only in deliberately public locations. Account for index and error internal redirects, trailing slashes, root/alias mapping, nested paths, and inherited IP rules, then validate with nginx -t and status/header checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
