location ~ .ht { deny all; } location ~ /core/js { allow all; } location ~ ^/(conf|backup|log|core) { deny all; } location ~ ^/storage/(.+).php { deny all; } location / { if (!-f $request_filename) { rewrite ^(.*)$ /index.php?$1 last; break; } }