I noticed this weekend that someone was pounding on /rss/catalog/notifystock/ trying to brute force the admin credentials. I've added a line to the nginx vhost.d conf that returns 403 when you attempt to visit /rss/catalog/notifystock/ effectively blocking this attack. I've also blocked /rss/order/new and /rss/catalog/review as I discovered they were vulnerable during my research.

When I check the nginx access log I still see them pounding away. The access log shows it is returning a 301 instead of the 403 they should be seeing. Any ideas on why I might be seeing the 301?

1 Answer 1


Do you need /rss?

If not, just do this in your nginx server {} block

location ~ ^/index.php/?rss/ {
    deny all;
location ~ ^/rss/ {
    deny all;
  • There are a couple of RSS feeds that the client is using. The server block in nginx.conf in commented out and the conf.d and vhost.d conf files are being used.
    – user68760
    Jun 26, 2018 at 17:58
  • in that case, it might make sense to block all /rss except the url's your client is using? Jun 27, 2018 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.