From a025964640e4422b9811e70a5eac83b939655638 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= <francois+github@kubler.org>
Date: Wed, 18 Jun 2025 12:06:46 +0200
Subject: [PATCH] fix(bedrock): allow access to well-known URLs

---
 conf/nginx/bedrock-wordpress.conf.erb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/conf/nginx/bedrock-wordpress.conf.erb b/conf/nginx/bedrock-wordpress.conf.erb
index 3e3f4fe7..1384eba5 100644
--- a/conf/nginx/bedrock-wordpress.conf.erb
+++ b/conf/nginx/bedrock-wordpress.conf.erb
@@ -7,8 +7,10 @@ location / {
 
 rewrite /wp-admin$ $scheme://$host$uri/ permanent;
 
-location ~ /\. {
-	deny all;
+# Prevent clients from accessing hidden files (starting with a dot)
+# Access to `/.well-known/` is allowed.
+location ~* /\.(?!well-known\/) {
+	 deny all;
 }
 
 location ~* /(?:uploads|files)/.*\.php$ {