@@ -324,14 +324,17 @@ The **minimum configuration** to get your application running under Nginx is:
324324..tip ::
325325
326326 This executes **only ** ``app.php ``, ``app_dev.php `` and ``config.php `` in
327- the web directory. All other files will be denied. You **must ** also make
328- sure that if you *do * deploy ``app_dev.php `` or ``config.php `` that these
329- files are secured and not available to any outside user (the IP address
330- checking code at the top of each file does this by default).
327+ the web directory. All other files ending in ".php" will be denied.
331328
332329 If you have other PHP files in your web directory that need to be executed,
333330 be sure to include them in the ``location `` block above.
334331
332+ ..caution ::
333+
334+ After you deploy to production, make sure that you **cannot ** access the ``app_dev.php ``
335+ or ``config.php `` scripts (i.e. ``http://example.com/app_dev.php `` and ``http://example.com/config.php ``).
336+ If you *can * access these, be sure to remove the ``DEV `` section from the above configuration.
337+
335338For advanced Nginx configuration options, read the official `Nginx documentation `_.
336339
337340.. _`Apache documentation` :http://httpd.apache.org/docs/