Hiding .user.ini file

Hello everyone,
user.ini file in my website root folder appears to be not hidden.
I’ve read a lot of topics about this issue, so I’ve tried with these two methods:

1. Editing .htaccess, adding

   <Files “.user.ini”>
   <IfModule mod_authz_core.c>
   Require all denied
   </IfModule>
   <IfModule !mod_authz_core.c>
   Order deny,allow
   Deny from all
   </IfModule>
   </Files>

   but I don’t have .htaccess file and creating a new one doesn’t solve anything

2. Edit nginx.conf file adding:

   location ~ \.user\.ini$ {
                 deny all;
   }

   to the server block and restarting nginx, but it’s not working.

   I am using https protocol, I don’t know if it matters and I have to edit another file…

   Sources:
   – https://ww.wp.xz.cn/support/topic/security-issue-user-ini-file/
   – https://ww.wp.xz.cn/support/topic/mydomain-com-user-ini/

• This topic was modified 6 years, 7 months ago by WPSani.