When downloading Drupal, I get .htaccess files which contain Apache directives, including security-related configuration directives.

  1. Can Drupal 8 work, out of the box, with Nginx?

  2. Where are the Nginx files equivalent to the Apache configuration files? If there isn't any file for Nginx, how can I know how to create them?


2 Answers 2


Nginx doesn't support .htaccess files without an extension. You could install that extension, but most don't.

Drupal doesn't include sample rewrite config for Nginx, so there are a few extra steps when setting up the vhost, but nothing major. You'll also need to make sure FPM is set up and configured correctly, but that goes without saying when using PHP with nginx.

There's a pretty sensible looking sample config on the Nginx site itself:

server {
    server_name example.com;
    root /var/www/drupal8; ## <-- Your only path reference.

    location = /favicon.ico {
        log_not_found off;
        access_log off;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;

    # Very rarely should these ever be accessed outside of your lan
    location ~* \.(txt|log)$ {
        deny all;

    location ~ \..*/.*\.php$ {
        return 403;

    location ~ ^/sites/.*/private/ {
        return 403;

    # Allow "Well-Known URIs" as per RFC 5785
    location ~* ^/.well-known/ {
        allow all;

    # Block access to "hidden" files and directories whose names begin with a
    # period. This includes directories used by version control systems such
    # as Subversion or Git to store control files.
    location ~ (^|/)\. {
        return 403;

    location / {
        # try_files $uri @rewrite; # For Drupal <= 6
        try_files $uri /index.php?$query_string; # For Drupal >= 7

    location @rewrite {
        rewrite ^/(.*)$ /index.php?q=$1;

    # Don't allow direct access to PHP files in the vendor directory.
    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;

    # In Drupal 8, we must also match new paths where the '.php' appears in
    # the middle, such as update.php/selection. The rule we use is strict,
    # and only allows this pattern with the update.php front controller.
    # This allows legacy path aliases in the form of
    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
    # you do not have any paths like that, then you might prefer to use a
    # laxer rule, such as:
    #   location ~ \.php(/|$) {
    # The laxer rule will continue to work if Drupal uses this new URL
    # pattern with front controllers other than update.php in a future
    # release.
    location ~ '\.php$|^/update.php' {
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        # Security note: If you're running a version of PHP older than the
        # latest 5.3, you should have "cgi.fix_pathinfo = 0;" in php.ini.
        # See http://serverfault.com/q/627903/94922 for details.
        include fastcgi_params;
        # Block httpoxy attacks. See https://httpoxy.org/.
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_intercept_errors on;
        # PHP 5 socket location.
        #fastcgi_pass unix:/var/run/php5-fpm.sock;
        # PHP 7 socket location.
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;

    # Fighting with Styles? This little gem is amazing.
    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
        try_files $uri @rewrite;

    # Handle private files through Drupal.
    location ~ ^/system/files/ { # For Drupal >= 7
        try_files $uri /index.php?$query_string;

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
  • 1
    nginx doesn't support any file-based overrides natively, those directives go in the vhost. Any per-folder overrides also go in the vhost
    – Clive
    Commented Sep 19, 2016 at 7:01
  • I'm not sure what you're hoping the bounty will achieve? There isn't any more information to give you based on your question, it's a waste. If you don't understand what you're looking at with regards to the sample vhost in the answer, no amount of Drupal knowledge is going to help, that's all nginx config which like everything else, you need to learn separately
    – Clive
    Commented Sep 19, 2016 at 8:10
  • 2
    Absolutely, couldn't agree more. But I'm wondering if the 2 questions haven't been answered properly what sort of clarification you need? I'm happy to elaborate on something if there's confusion/ambiguity in the answer (not interested in the bounty, have far too many unicorn points as it is)
    – Clive
    Commented Sep 19, 2016 at 22:14

Drupal works with nginx, but it takes a great deal of research to get it right (and keep it right). If you have the time and resources to do that well many people are very happy with the performance of their sites once up and running.

Because there is no official community supported documentation covering how to setup nginx, you don't get the reassurance that the security team has reviewed the setup (or anyone else really). If you search around you'll find many partial answers, but I've found that all are incomplete in some way and most contain security errors. As Pierre notes in the comment below there is a quiet group that has worked on this for D6 and D7 but not yet for D8.

One of the most common basic issues is that many are focused on getting Drupal to do all the things it is supposed to do (like generate images) but don't prevent things that are supposed to be blocked (like directly accessing .twig or .inc files). The more complex security issues – like recent changes to headers to mitigate certain types of attacks – are totally absent from any examples I've seen for nginx.

Also, if you run many sites you are likely to have times when you need to change the configuration of all your sites, which means an update to all vhosts. With Apache those changes are often just a matter of pushing out the new code base since the .htaccess files update Apache's behavior.

  • 1
    In addition, there is a community group for nginx, but it's rather quite. github.com/perusio/drupal-with-nginx seems to be a good base (but complexe) nginx config for Drupal 7 and 6, but there is no version for Drupal 8. Commented Sep 20, 2016 at 15:08
  • If you look at the current .htaccess file you'll see near the end headers with comments that say things like # Disable content sniffing, since it's an attack vector. Those are fairly recent additions and not things I've seen accounted for in sample nginx settings (there are probably places that have them, just not where I've looked). The real issue is that you have to watch for changes to .htaccess with every update, and translate them to nginx.
    – acrosman
    Commented Sep 21, 2016 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.