The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The PHP-FPM message Access to the script ... has been denied (see security.limit_extensions) means FPM received a main-script path whose extension is not allowed by the pool, or your web server built the wrong path and sent a directory or PATH_INFO as the script. For a normal PHP application, keep the pool restricted to .php, correct the FastCGI path mapping, reload the pool that actually serves the request, and then test both the failing URL and a known-good PHP file.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the PHP-FPM error actually means
security.limit_extensions is an allow-list for the extension of the main script that PHP-FPM will parse. PHP documents the directive as limiting “the extensions of the main script FPM will allow to parse.” Its security purpose is to stop a web-server configuration mistake from allowing files with unrelated extensions to execute PHP code.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For an ordinary PHP site, the safest policy is a single allowed extension:
security.limit_extensions = .phpPHP’s manual documents .php .phar as the default for the documented configuration. However, the distributed pool template may show a commented example such as ;security.limit_extensions = .php .php3 .php4 .php5 .php7, along with a note that an empty value allows every extension. Those are not proof of the active setting on your server. Package version and local pool files differ, so the uncommented directive in the pool serving your request is authoritative.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Why a directory or text after .php can trigger the same message
FPM checks the path it receives as the main script, not the URL as a human sees it. If NGINX maps a request incorrectly, FPM may receive a directory-like path or the part of a URL that should have been PATH_INFO. It then applies the extension policy to that malformed path and reports an extension denial even though the application’s real file ends in .php.
For example, a request shaped like /show.php/article/0001 contains a script path (/show.php) and additional path information (/article/0001). NGINX’s documented fastcgi_split_path_info pattern separates those components. If the split or SCRIPT_FILENAME value is wrong, FPM can be handed the wrong component as the script.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStart with the exact path in the denial
Read the PHP-FPM log and the web-server error log for the same request. Copy the complete path shown after “Access to the script.” Do not change the allow-list until you know what FPM is actually rejecting.
| Path shown in the message | Most likely direction | First check |
|---|---|---|
A real file ending in .php |
The request reached an unexpected pool, or the filename does not match the active document root. | Confirm the uncommented pool setting and that NGINX’s fastcgi_pass points to that pool’s socket or host and port. |
| A directory, directory-like path, or a path with no PHP suffix | FastCGI routing built the wrong script path. | Inspect SCRIPT_FILENAME, the document root, and any PATH_INFO split before changing the extension policy. |
The portion after .php, such as /article/0001 |
PATH_INFO was treated as part of the script name. | Use an explicit fastcgi_split_path_info rule if the application intentionally uses this URL style. |
PHP Bug #68053 records this same class of denial when PATH_INFO and script-path handling cause FPM to receive a directory-like path. That makes the rejected path a routing clue, not merely a request to broaden the extension list.
Fix the problem without weakening PHP-FPM
1. Identify the pool that serves the request
Find the pool file handling the URL. It is often named www.conf or stored below a pool.d directory, but the exact location depends on the operating-system package. Inspect the uncommented value of security.limit_extensions; comments and example lines do not affect FPM.
Use the narrowest list that matches the application. If it is a conventional PHP application, leave the value at .php. Do not use an empty value simply to suppress the warning: the PHP pool template says an empty value permits all extensions, and PHP’s security guidance recommends allowing only .php unless another suffix is deliberately executed as PHP.
Recommended Free Tools
2. Verify that NGINX passes the real filename
In a conventional NGINX site, the PHP location must construct the actual filesystem path to the script in SCRIPT_FILENAME. The essential configuration shape is:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php-fpm.sock;
}The socket in this example is illustrative. Replace it with the socket or host-and-port belonging to the pool you inspected. NGINX documents that SCRIPT_FILENAME is the parameter PHP uses to determine the script name. A wrong document root, a stale symlink path, or a URI variable used in place of the filesystem path can therefore produce the security-limit error.
Check the complete request path, not just the location block. A more specific NGINX location, an included configuration file, or a different virtual host may be handling the failing URL. The effective fastcgi_pass and SCRIPT_FILENAME must be evaluated together: changing a pool that is not connected to that socket will have no effect.
3. Split PATH_INFO when the application uses it
If URLs intentionally place extra path data after the PHP filename, use an explicit split. NGINX’s documented pattern is:
location ~ ^(.+.php)(/.*)$ {
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass unix:/run/php/php-fpm.sock;
}Here, $fastcgi_script_name represents the part ending in .php, while $fastcgi_path_info carries the suffix beginning with the slash. Keep the same pool-specific socket or host-and-port you verified in the previous step. If your application does not use PATH_INFO, do not add a broad rule merely because the error mentions a path; instead, keep the simpler PHP location and reject malformed requests.
4. Reject nonexistent scripts before FastCGI
Keep an existence check such as try_files $uri =404; before handing a request to FPM, or use the equivalent rule provided by your platform. This prevents a typo, directory, or upload path from being presented as the main PHP script. It also makes the failure easier to interpret: a missing file becomes a web-server 404 rather than an apparently mysterious extension denial in FPM.
5. Test the configuration using your package’s command
Run the PHP-FPM configuration-test command supplied by your operating-system package. Service names, binary paths, and pool directories differ by distribution, so do not copy a version-specific command blindly. Correct any syntax error before reloading.
Reload or restart the matching PHP-FPM service, then reload NGINX if you changed its configuration. The reload must affect the pool connected to the socket named in fastcgi_pass; restarting a different PHP version leaves the original error unchanged.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
6. Test two requests while watching both logs
- Request the URL that previously failed and confirm that the denied path no longer appears.
- Request a known-good file ending in
.phpfrom the same virtual host and document root. - For a PATH_INFO application, test one URL containing the suffix after
.phpand confirm that the script path andPATH_INFOare separated. - Watch the PHP-FPM and NGINX logs during each request. A new 404, permission error, or upstream socket error is a different problem and should be fixed without broadening
security.limit_extensions.
Choosing an extension policy
Only expand the allow-list when the application deliberately executes another extension as PHP and you have verified that behavior. The decision involves security scope, application compatibility, routing correctness, and operational impact.
| Policy | Security scope | When it fits | Risk or cost |
|---|---|---|---|
.php |
Narrowest | Normal PHP applications and the recommended default for most sites. | Any intentionally executable non-.php legacy file will be denied until it is migrated or explicitly considered. |
.php .phar |
Broader than PHP-only | Only where the application intentionally runs PHAR files through FPM. | Every additional executable suffix expands the set of files that can run PHP code. |
| A deliberate multi-extension list | Broader and application-specific | Legacy software that has been audited and genuinely requires named suffixes. | More opportunities for an upload, backup, or misrouted file to execute as PHP; routing still must be correct. |
| Empty value | All extensions | Not a normal fix; it removes the extension restriction. | The source pool template states that an empty value allows all extensions, defeating the protection. |
An extension change cannot repair a bad SCRIPT_FILENAME. If the rejected path is a directory or the text after .php, fix routing first. If the rejected path is a legitimate, deliberately executable legacy suffix, document that requirement, add only that suffix, and retest the complete request path.
Common wrong fixes and why they fail
Adding arbitrary suffixes
Adding .html, image extensions, backup suffixes, or a long historical list may make one request pass, but it allows more files to execute PHP code. PHP recommends PHP-only execution unless another extension is intentional. A successful response is not evidence that the resulting policy is safe.
Setting the value to empty
An empty security.limit_extensions value is not “no restriction for this one file”; it permits all extensions for that pool. It hides the symptom while removing the control intended to catch web-server mistakes.
Editing the wrong pool
FPM can run multiple pools and PHP versions. If NGINX sends the request to another socket, editing an unused www.conf cannot change the result. Match the pool file to the exact fastcgi_pass target before reloading.
Using a URI as the filename
SCRIPT_FILENAME must resolve to the real script path. A URL path, an incorrect document root, or a symlink target that differs from the active site root can cause FPM to inspect a nonexistent or directory-like path. Correct that mapping instead of expanding the allow-list.
Treating PATH_INFO as an extension problem
When the error contains the portion after .php, the application’s routing convention and NGINX’s split rule are the primary suspects. The PHP Bug #68053 record demonstrates why this class of failure should be investigated as path handling.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Troubleshooting by symptom
The log still shows a directory after the reload
- Confirm that the failing host uses the NGINX configuration you edited.
- Check whether a more specific location block overrides the PHP block.
- Verify that
try_filesruns before FastCGI forwarding. - Inspect whether a trailing slash or PATH_INFO suffix is being appended to the script variable.
- Confirm that the PHP-FPM reload reached the service owning the configured socket.
A real .php file is denied
- Read the active, uncommented
security.limit_extensionsvalue in the serving pool. - Check for a different PHP-FPM pool or version behind
fastcgi_pass. - Compare the document root in NGINX with the actual location of the file.
- Check for a spelling, case, or symlink mismatch in the path shown by the log.
- Validate and reload the configuration after correcting the mismatch.
The basic PHP file works but the routed URL fails
- The pool and socket are probably reachable, so focus on the URL-to-script mapping.
- If the URL contains text after
.php, apply the explicit PATH_INFO split shown above. - Ensure
SCRIPT_FILENAMEuses$fastcgi_script_nameafter the split and passesPATH_INFOseparately. - Retest a URL without PATH_INFO to keep a working baseline while debugging the route.
The error disappears but unrelated files begin executing
Undo any broad extension change and restore the narrowest policy that the application supports. Review the pool file for an empty value or arbitrary suffixes, then correct the FastCGI mapping that caused the original path to be misidentified. The goal is a correct script path plus a restricted allow-list, not merely a quiet log.
Use a controlled change and rollback plan
Make one related change at a time. First record the denied path, pool name, socket target, document root, and current uncommented extension value. Save a copy of the pool and NGINX files or use your configuration system’s normal revision history. This gives you a precise rollback if a reload exposes a syntax error or changes another virtual host.
Prefer correcting the mapping before changing policy. If the log shows a directory or a suffix after .php, changing security.limit_extensions treats the symptom and may create a larger execution surface. Once the path is a real script, compare its suffix with the allow-list. Only then should a deliberate legacy requirement be considered.
After editing, validate both configurations before reloading. A successful test confirms syntax, not that the intended pool is serving traffic, so follow it with a request through the exact virtual host and URL that failed. Keep a known-good PHP request as a control. If that control also fails, investigate the socket, service, document root, or permissions rather than the original route alone.
On managed platforms, pool files may be generated or replaced during deployment. In that case, make the change through the provider’s supported configuration mechanism and ask whether a custom include or per-site setting is available. Sending the administrator the denied path and the active fastcgi_pass target is more useful than requesting that all extensions be enabled.
How to distinguish a policy failure from a routing failure
A policy failure has a legitimate script path and a suffix that is absent from the active allow-list. A routing failure has a path that should never have been presented as the main script: a directory, a missing file, or the portion after the PHP filename. The distinction matters because the safe remedy is different.
| Observation | Interpretation | Safe next action |
|---|---|---|
The denied path is /site/index.php, and the active pool allows only another deliberate suffix. |
Potential policy mismatch. | Confirm that the request uses the expected pool, then restore or set the application’s intended PHP suffix. |
| The denied path ends in a slash or resembles a directory. | Bad script construction or missing-file handling. | Correct SCRIPT_FILENAME, document root, and existence checking. |
The denied path is /article/0001 after a .php URL. |
PATH_INFO was not separated. | Apply the explicit split only if the application uses that URL convention. |
| A known-good PHP file fails after editing NGINX. | The broader FastCGI change affected the baseline. | Review the effective location block, restore the last working mapping, and validate again. |
Verification checklist
- The denied path was copied from the log and classified as a real script, directory, or PATH_INFO suffix.
- The active pool and its uncommented
security.limit_extensionsvalue were identified. - The policy is
.phpunless a documented application requirement justifies another suffix. SCRIPT_FILENAMEresolves to the real file under the active document root.fastcgi_passpoints to the pool that was edited and reloaded.try_files $uri =404;, or an equivalent existence check, runs before FastCGI for conventional PHP routing.- PATH_INFO is split explicitly when the application uses URLs such as
/show.php/article/0001. - The PHP-FPM configuration test passed before reload.
- The failing URL and a known-good
.phpfile both work while logs are monitored.
When to involve a hosting or server administrator
Ask for PHP-FPM support or managed PHP hosting assistance when you cannot identify which pool owns the socket, when several PHP versions share the same host, or when a platform regenerates pool files after each deployment. Provide the exact denied path, the virtual host, the fastcgi_pass target, and the active pool setting. That information lets an administrator correct the mapping without resorting to an unrestricted extension policy.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The practical fix
Keep security.limit_extensions narrow, normally .php. Use the path in the log to decide whether the failure is an extension-policy mismatch or a malformed script path. Then align NGINX’s SCRIPT_FILENAME, document root, existence check, and optional PATH_INFO split with the pool and socket that actually serve the request. Validate, reload the matching services, and verify both the original URL and a known-good PHP file.
Frequently Asked Questions
Why does PHP-FPM say “Access to the script has been denied (see security.limit_extensions)”?
FPM received a main-script path whose suffix is not allowed by the active pool, or NGINX passed a directory or PATH_INFO portion as the script. Copy the exact denied path from the log before changing the allow-list.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Should I set security.limit_extensions to an empty value?
No. The pool template states that an empty value allows all extensions, which removes the protection. Keep the value at .php for a normal application and fix the FastCGI mapping if the rejected path is malformed.
Why does a URL such as /show.php/article/0001 fail while show.php works?
The text after .php may be reaching FPM as part of the script name. Configure the documented NGINX fastcgi_split_path_info pattern, pass $fastcgi_script_name in SCRIPT_FILENAME, and pass the suffix separately as PATH_INFO.
I added an extension and the error disappeared. Is the server fixed?
Not necessarily. If the original path was a directory or a routing suffix, the change only broadened which files can execute PHP. Restore the narrow policy and correct SCRIPT_FILENAME, the document root, or PATH_INFO handling.
How do I know whether I edited the correct PHP-FPM pool?
Match the pool file and its uncommented setting to the socket or host-and-port named by NGINX’s fastcgi_pass. Reload that exact service, then test a known-good PHP file through the same virtual host.
What should I give a hosting provider for PHP-FPM support?
Provide the complete denied path, the affected virtual host and URL, the fastcgi_pass target, the active document root, and the uncommented security.limit_extensions value. These details identify the routing or pool mismatch without requiring an unrestricted policy.
The Bottom Line
Keep PHP-FPM limited to .php unless a documented application requirement says otherwise. Use the exact denied path to distinguish an allow-list mismatch from a broken NGINX script mapping, fix SCRIPT_FILENAME and PATH_INFO handling, validate the configuration, reload the matching pool, and retest both the failing route and a known-good PHP file.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
