• Centos 7
  • Nginx 1.10.2
  • PHP Version 7.1.5
  • Database 5.5.52-MariaDB
  • Drupal 8.3.2

I have exhausted just about every possible google result and every forum post I can feasibly find. Thank you in advance for any help you can offer me.

PROBLEM: Images are uploading to the appropriate folders under /sites/default/files/WHATEVER-SUBDIRECTORY

Image styles are not generating under the /styles folder and I am getting broken images whenever they should appear on-page.


  • Rewriting my Nginx config.
  • Setting all permissions to 777 (for testing purposes).
  • Adding $conf['image_allow_insecure_derivatives'] = TRUE; to settings.php.
  • All directories and files are owned by the correct user/group.
  • Flushing cache as well as image stores.
  • The only type of errors I have been able to find are in my nginx access.log: "GET /sites/default/files/styles/large/public/2017-05/my_image.jpg?itok=Ax9jzc70 HTTP/1.1" 404 571 "https://mysite.mysite.come/node/1" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.96 Safari/537.36" "-"Safari/537.36" "-"


user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    server {
        listen 443 ssl http2;
        server_name     mysite.mysite.com;
        root /var/www/drupal;
        ssl_certificate SSL CERT HERE;
        ssl_certificate_key SSL CERT KEY HERE;
        ssl_session_cache shared:SSL:100m;
        ssl_session_timeout 30m;
        ssl_protocols TLSv1.1 TLSv1.2;

    location / {
        try_files       $uri /index.php?$query_string;

    location @rewrite {
        rewrite ^/(.*)$ /index.php?q=$1;

    location ~ /vendor/.*\.php$ {
        deny    all;
        return  404;

    location ~ \.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        include fastcgi_params;
        fastcgi_param   HTTP_PROXY "";
        fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param   PATH_INFO $fastcgi_path_info;
        fastcgi_param   QUERY_STRING $query_string;
        fastcgi_intercept_errors        on;

    location ~ ^(/[a-z\-]+)?/system/files/ {
        try_files $uri /index.php?$query_string;

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found   off;


    location ~* /sites/.*/files/styles { # For Drupal >= 7
        access_log      off;
        expires         max;
        try_files $uri @rewrite;

server {
listen       80 default_server;
server_name  mysite.mysite.com;
root         /var/www/drupal;
return 301 https://$server_name$request_uri;

Everything else seems to be working like a dream, but I can't for the life of me seem to figure out these image styles. Any guidance would be greatly appreciated. Thanks again.

  • You may try this pattern location ~ ^/sites/.*/files/styles/ instead of location ~* /sites/.*/files/styles . Also have a look at styles and subfolders permissions, and give rwx permission to nginx user (in most cases, www-data, be with apache or nginx) – Kojo May 16 '17 at 10:42
  • Thanks for the response, but unfortunately this didn't work. Tried the suggested nginx config change and set all permissions recursively to 777 throughout the entire drupal deployment (for testing purposes). :-/ – Papat0k May 16 '17 at 15:18

I finally found a solution to this problem! As it turns out, systemd is configured to give php-fpm a private /tmp. I had to edit the .service file to set PrivateTmp=false. It is worth noting that if you're running multiple sites on of the same server, PrivateTmp should be set to =true for security reasons.

For reverence, here is the thread that saved my rump in the end.

Thanks again.


I had a very similar problem to yours, and found out that to image URL was added "?h=xxxxxxx&" before "itok=", so after deleting this string and pasting URL in browsers, these files were created without any problems.

The only way I found out how to remove this strings from being added was to add in settings.local.php (or settings.php depend on how You config your website) this line:

$config['image.settings']['allow_insecure_derivatives'] = TRUE;


I had a similar issue and it turns out it was because mod_rewrite wasn't enabled in apache2


as for me, this one was caused by nginx config issue just replace "location" directive with one below:

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
            try_files $uri @rewrite;
            expires max;
            log_not_found off;

and reload nginx sudo systemctl start nginx ( on cent os )

it helped me

rights on sites/default/files 775 owner nginx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.