LimeSurvey nginx example configuration

Nginx configuration example for LimeSurvey

Below is an example configuration for running LimeSurvey with nginx and PHP-FPM. Adjust paths, domain names, and PHP-FPM socket/port settings to match your server setup.

Note: This is a basic example. Always review and adapt it to your own security requirements before using it in production.

server {
    listen 80;
    server_name survey.example.com;
    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name survey.example.com;

    root /var/www/limesurvey;
    index index.php;

    # SSL certificates
    ssl_certificate     /etc/ssl/certs/survey.example.com.crt;
    ssl_certificate_key /etc/ssl/private/survey.example.com.key;

    # Recommended SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    client_max_body_size 100M;

    access_log /var/log/nginx/limesurvey_access.log;
    error_log  /var/log/nginx/limesurvey_error.log;

    location / {
        index  index.html index.php;
        try_files $uri $uri/ /index.php?$args;
    }

    # Deny access to directories that are only used on the server
    # ^~ gives these locations priority over the PHP location below, so PHP files in them are never executed
    location ^~ /application/ { deny all; }
    location ^~ /vendor/      { deny all; }
    location ^~ /docs/        { deny all; }
    location ^~ /locale/      { deny all; }
    location ^~ /modules/     { deny all; }
    location ^~ /tmp/runtime/ { deny all; }
    location ^~ /tests/       { deny all; }

    # Uploaded files: never execute scripts, never deliver files uploaded by participants directly
    location ^~ /upload/ {
        location ~* \.(php\d?|phtml|pl|py|pyc|pyo|cgi|pcgi\d?|sh|lua|icn)$ {
            deny all;
        }
        location ~ ^/upload/surveys/.*/fu_[a-z0-9_]*$ {
            deny all;
        }
        try_files $uri =404;
    }

    # Regular expression locations are checked in order and the first match wins,
    # so all deny rules below must stay above the PHP location

    # Deny access to hidden files and directories, except .well-known
    location ~ /\.(?!well-known) {
        deny all;
    }

    # Deny access to the internal directories of the KCFinder file manager
    location ~ ^/assets/packages/kcfinder/(conf|core|doc|integration|lang|lib|tpl)/ {
        deny all;
    }

    # Deny access to development, build and debug files in the LimeSurvey root directory
    location ~ ^/(setdebug\.php|open-api-gen\.php|composer\.(json|lock)|package\.json|yarn\.lock|gulpfile\.js|phpunit\.xml|psalm(-\w+)?\.xml|phpci\.yml|phpcs\.ruleset\.xml|publiccode\.yml|manifest\.yml|CONTRIBUTING\.md|README\.md|SECURITY\.md)$ {
        deny all;
    }

    location ~* \.(log|sql|htaccess)$ {
        deny all;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
    }
}

Explanation of key directives

• fastcgi_pass: Points to the PHP-FPM socket or TCP address handling PHP requests. Update this to match your PHP-FPM pool configuration.
• try_files: Ensures URLs are routed correctly through LimeSurvey's front controller (index.php).
• client_max_body_size: Increases the maximum upload size, useful for surveys with file-upload questions.
• Deny rules: Block direct web access to configuration files, logs, and application directories that should never be publicly reachable. nginx checks regular expression locations in the order they appear, and the first match wins. Keep the deny rules above the PHP location, otherwise PHP files in these directories are executed instead of denied.
• Installation in a subdirectory: The example assumes that LimeSurvey is installed in the document root. If you install it in a subdirectory, add the subdirectory to the paths of the deny rules, for example location ^~ /limesurvey/vendor/.