I've set up a redirect so I can serve my PHP files without the .php extension, but whenever I visit a "clean" url, my browser downloads the file, suggesting NGINX isn't hosting it as a PHP file.

How can I fix this issue (and security hole)?

The config:

server {
    listen       80;
    server_name  www.example.com;
    root         /var/www/html/public;

    location / {
        try_files $uri $uri/ @extensionless-php;
        index index.html index.htm index.php;

    location ~ \.php$ {
        try_files $uri =404;
        include       /etc/nginx/fastcgi_params;
        fastcgi_pass  unix:/var/run/php5-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    location @extensionless-php {
        rewrite ^(.*)$ $1.php last;

1 Answer 1


Using the Chrome Inspector Network tab, review the raw HTTP response headers set for this configuration vs a working PHP page. You will see the Content-Type is different between the pages. It is the alternative Content-Type that causes the browser to respond by downloading the file rather than displaying it.

In your @extensionless-php block, try adding this to force the Content-Type back to a standard HTML MIME type:

 default_type text/html;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .