Infinite redirect loop during phpMyFAQ installation ("Redirecting to ./setup/.")

[yangqiceng]

Hi,

I'm trying to install phpMyFAQ, but I'm encountering an issue during the setup process.

After I fill in all the required information and click Submit, the page shows:

Redirecting to ./setup/.

Then the browser keeps reloading, and the URL continuously appends new /setup/ segments — for example:

/setup/
/setup/setup/
/setup/setup/setup/

It goes into an infinite redirect loop and never finishes.

Here’s some additional information about my environment:

PHP version: 8.2

Web server: Nginx (via BT Panel)

OS: CentOS

Permissions: all web files currently owned by root

Required PHP extensions are installed (except LDAP, which I assume is optional)

Has anyone experienced this issue before or knows what might be causing it?

Thanks in advance for your help!

[thorsten]

@yangqiceng did you change the nginx configuration of your server? Which version of phpMyFAQ do you use?

[yangqiceng]

No, I didn’t modify the Nginx configuration. There are several other WordPress-based sites running on this server, and they all work normally. I downloaded the latest version from the official website. Thanks again for your reply.

[thorsten]

You need to adjust the nginx configuration as described in our documentation.

[yangqiceng]

You need to adjust the nginx configuration as described in our documentation.

I only saw this sentence in the official documentation: “Nginx 1.0 or later (with URL rewriting) and SSL support).”But my other websites are working fine.Can you give me more information?

[thorsten]

The nginx condfiguration is here: https://github.com/thorsten/phpMyFAQ/blob/main/nginx.conf

[yangqiceng]

The nginx condfiguration is here: https://github.com/thorsten/phpMyFAQ/blob/main/nginx.conf

Thank you for your reply. I have configured everything according to the link you provided, but it still doesn’t work. The browser shows the following message:

The page isn’t redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

This problem can sometimes be caused by disabling or refusing to accept cookies.

The address bar also shows countless /setup/. I have attached my configuration file and hope to get your help. Thank you.

`#nginx
server {
listen 80;
listen 443 ssl http2;
server_name yourdomain.com;
index index.php index.html index.htm default.php default.htm default.html;
root /path/to/your/webroot;

#CERT-APPLY-CHECK--START
include /path/to/panel/vhost/nginx/well-known/yourdomain.com.conf;
#CERT-APPLY-CHECK--END
include /path/to/panel/vhost/nginx/extension/yourdomain.com/*.conf;

# SSL
ssl_certificate /path/to/cert/yourdomain.com/fullchain.pem;
ssl_certificate_key /path/to/cert/yourdomain.com/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_tickets on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;

# Error page
error_page 404 /index.php;

# PHP
include enable-php-xx.conf;

# Rewrite rules
include /path/to/panel/vhost/rewrite/yourdomain.com.conf;

# 禁止访问文件
location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md) {
    return 404;
}

# SSL证书验证目录允许访问
location ~ \.well-known {
    allow all;
}

# 禁止在证书验证目录放入敏感文件
if ($uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$") {
    return 403;
}

# 缓存和静态文件处理
location ~* \.(jpg|jpeg|gif|png|webp|svg|ico|mp4|webm|mpeg|ttf|otf|woff|woff2|css|js|pdf)$ {
    expires 1y;
    add_header Cache-Control "public";
}

location ~* \.(svg|eot|ttf|woff|woff2|json)$ {
    add_header Access-Control-Allow-Origin "*";
}

location ~* \.(js)$ {
    expires 1y;
    add_header Cache-Control "public, max-age=31536000, immutable";
}

location ~* \.(css)$ {
    expires 1y;
    add_header Cache-Control "public, max-age=31536000, immutable";
}

# 主站入口
location / {
    index index.php;
    try_files $uri $uri/ @rewriteapp;
}

location @rewriteapp {
    rewrite ^ /index.php last;
}

# PHP 处理
location @php {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
    include /path/to/nginx/conf/fastcgi_params;
}

location ~ '/.+\.ph(p|tml)(/|$)' {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    include /path/to/nginx/conf/fastcgi_params;
}

location ~ /\.ht {
    deny all;
}

# 其他缓存规则保留原始
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    expires 2d;
    add_header Cache-Control "no-store";
}

access_log /path/to/logs/yourdomain.com.log;
error_log /path/to/logs/yourdomain.com.error.log;

}
`

[thorsten]

Yes, the rewrite handling for phpMyFAQ is missing.

[yangqiceng]

Sorry, I pasted the wrong one earlier. The following is my current configuration file, which already includes the rewrite rules.
`server {
listen 80;
listen 443 ssl http2;
server_name xxxxxxxxxx.com;
index index.php index.html index.htm default.php default.htm default.html;
root /disk/wwwroot/xxxxxxxxxx.com;

#CERT-APPLY-CHECK--START
include /www/server/panel/vhost/nginx/well-known/xxxxxxxxxx.com.conf;
#CERT-APPLY-CHECK--END
include /www/server/panel/vhost/nginx/extension/xxxxxxxxxx.com/*.conf;

# SSL
ssl_certificate /www/server/panel/vhost/cert/xxxxxxxxxx.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/xxxxxxxxxx.com/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_tickets on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;

# Error page
error_page 404 /index.php;

# PHP
include enable-php-82.conf;

# Rewrite rules
include /www/server/panel/vhost/rewrite/xxxxxxxxxx.com.conf;

# 禁止访问文件
location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md) {
    return 404;
}

# SSL证书验证目录允许访问
location ~ \.well-known {
    allow all;
}

# 禁止在证书验证目录放入敏感文件
if ($uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$") {
    return 403;
}

# 保留原缓存和静态文件处理规则
location ~* \.(jpg|jpeg|gif|png|webp|svg|ico|mp4|webm|mpeg|ttf|otf|woff|woff2|css|js|pdf)$ {
    expires 1y;
    add_header Cache-Control "public";
}

location ~* \.(svg|eot|ttf|woff|woff2|json)$ {
    add_header Access-Control-Allow-Origin "*";
}

location ~* \.(js)$ {
    expires 1y;
    add_header Cache-Control "public, max-age=31536000, immutable";
}

location ~* \.(css)$ {
    expires 1y;
    add_header Cache-Control "public, max-age=31536000, immutable";
}

# 主站入口
location / {
    index index.php;
    try_files $uri $uri/ @rewriteapp;
}

location @rewriteapp {
    # 原 @rewriteapp 所有重写规则保留
    rewrite ^/add-faq\.html$ /index.php?action=add last;
    rewrite ^/add-question\.html$ /index.php?action=ask last;
    rewrite ^/show-categories\.html$ /index.php?action=show last;
    rewrite ^/forgot-password/?$ /index.php?action=password last;
    rewrite ^/(search|open-questions|help|contact|glossary|overview|login|privacy|index)\.html$ /index.php?action=$1 last;
    rewrite ^/(login)$ /index.php?action=login last;
    rewrite ^/solution_id_([0-9]+)\.html$ /index.php?solution_id=$1 last;
    rewrite ^/bookmarks\.html$ /index.php?action=bookmarks last;
    rewrite ^/content/([0-9]+)/([0-9]+)/([a-z\-_]+)/(.+)\.htm(l?)$ /index.php?action=faq&cat=$1&id=$2&artlang=$3 last;
    rewrite ^/category/([0-9]+)/([0-9]+)/(.+)\.html$ /index.php?action=show&cat=$1&seite=$2 last;
    rewrite ^/category/([0-9]+)/(.+)\.html$ /index.php?action=show&cat=$1 last;
    rewrite ^/news/([0-9]+)/([a-z\-_]+)/(.+)\.html$ /index.php?action=news&newsid=$1&newslang=$2 last;
    rewrite ^/sitemap/([^\/]+)/([a-z\-_]+)\.htm(l?)$ /index.php?action=sitemap&letter=$1&lang=$2 last;
    rewrite ^/sitemap\.xml$ /sitemap.xml.php last;
    rewrite ^/sitemap\.gz$ /sitemap.xml.php?gz=1 last;
    rewrite ^/sitemap\.xml\.gz$ /sitemap.xml.php?gz=1 last;
    rewrite ^/robots\.txt$ /robots.txt.php last;
    rewrite ^/llms\.txt$ /llms.txt.php last;
    rewrite ^/tags/([0-9]+)/([0-9]+)/(.+)\.htm(l?)$ /index.php?action=search&tagging_id=$1&seite=$2 last;
    rewrite ^/tags/([0-9]+)/([^\/]+)\.htm(l?)$ /index.php?action=search&tagging_id=$1 last;
    rewrite ^/services/webauthn/(.*)$ /services/webauthn/index.php last;
    rewrite ^/user/(ucp|bookmarks|request-removal|logout|register)$ /index.php?action=$1 last;
    rewrite ^/admin/api/(.*)$ /admin/api/index.php last;
    rewrite ^/admin/(.*)$ /admin/index.php last;
    rewrite ^/api/v3\.[01]/(.*)$ /api/index.php last;
    rewrite ^/api/(.*)$ /api/index.php last;
    rewrite ^/api/setup/(check|backup|update-database)$ /api/index.php last;
    rewrite ^/setup/?$ /setup/index.php last;
    rewrite ^/update/?$ /update/index.php last;
    rewrite ^ /index.php last;
}

# PHP 处理
location @php {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
    include /www/server/nginx/conf/fastcgi_params;
}

location ~ '/.+\.ph(p|tml)(/|$)' {
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    include /www/server/nginx/conf/fastcgi_params;
}

location ~ /\.ht {
    deny all;
}

# 其他缓存规则保留原始
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    expires 2d;
    add_header Cache-Control "no-store";
}

access_log /www/wwwlogs/xxxxxxxxxx.com.log;
error_log /www/wwwlogs/xxxxxxxxxx.com.error.log;

}
`

[thorsten]

I'm not a nginx expert, sorry.

ChatGPT found these issues:

1. .well-known location is basically wrong

You have:

SSL证书验证目录允许访问

location ~ .well-known {
allow all;
}

For ACME / Let’s Encrypt you usually want to match /.well-known/… from the beginning.

With location ~ .well-known, Nginx’s regex is anchored at the start of the URI. The URI starts with /, but your pattern starts with . – so it won’t match /.well-known/... as intended.

👉 Better:

location ^~ /.well-known/ {
allow all;
}

This matches the directory correctly and gives it high priority.

Your if for blocking sensitive files under .well-known is fine:

if ($uri ~ "^/.well-known/.*.(php|jsp|py|js|css|lua|ts|go|zip|tar.gz|rar|7z|sql|bak)$") {
return 403;
}

⸻

2. Conflicting / ineffective cache rules

You have multiple overlapping location ~* blocks for static files:

location ~* .(jpg|jpeg|gif|png|webp|svg|ico|mp4|webm|mpeg|ttf|otf|woff|woff2|css|js|pdf)$ {
expires 1y;
add_header Cache-Control "public";
}

location ~* .(svg|eot|ttf|woff|woff2|json)$ {
add_header Access-Control-Allow-Origin "*";
}

location ~* .(js)$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

location ~* .(css)$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

其他缓存规则保留原始

location ~* .(js|css|png|jpg|jpeg|gif|ico)$ {
expires 2d;
add_header Cache-Control "no-store";
}

How Nginx actually behaves with regex locations:
• Nginx tests regex location ~ / ~* in the order they appear.
• The first matching regex wins. It does not choose “most specific”.

So:
• For .js and .css, the first big rule already matches:

location ~* .(...|css|js|...)$ { ... }

→ everything below for .js / .css is never used.

•	The last rule with expires 2d; Cache-Control "no-store" is effectively dead code for js|css|png|jpg|jpeg|gif|ico, because the earlier big rule wins first.
•	Your font CORS rule might also not be used for svg|ttf|woff|woff2 due to that first big catch-all rule.

👉 Fix: either remove the duplicated rules or reorder so that specific rules come first and the generic “catch-all” comes last. For example:

Fonts with CORS

location ~* .(eot|ttf|woff|woff2|svg)$ {
add_header Access-Control-Allow-Origin "*";
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

JS

location ~* .js$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

CSS

location ~* .css$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

Images, video, pdf (fallback)

location ~* .(jpg|jpeg|gif|png|webp|ico|mp4|webm|mpeg|pdf)$ {
expires 1y;
add_header Cache-Control "public";
}

…and then remove the final location ~* .(js|css|png|...) with no-store unless you truly want no caching.

⸻

3. SSL configuration (not “wrong”, but outdated)

Not a syntax error, but:

ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

•	TLSv1.1 is deprecated and often fails security scans.
•	Modern setups typically use:

ssl_protocols TLSv1.2 TLSv1.3;

Also, for HSTS:

add_header Strict-Transport-Security "max-age=31536000";

Common best practice:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

(Adjust includeSubDomains and preload only if you’re sure you want that.)

⸻

4. PHP handling

You have:

location @php {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
include /www/server/nginx/conf/fastcgi_params;
}

location ~ '/.+.ph(p|tml)(/|$)' {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
include /www/server/nginx/conf/fastcgi_params;
}

•	The location ~ '/.+\.ph(p|tml)(/|$)' is syntactically okay (the regex is in quotes, but that’s allowed).
•	The @php named location is never referenced in your snippet. That’s not an error, just unused config. You can either:
•	use try_files ... @php; somewhere, or
•	remove the @php block if it’s not needed.

⸻

5. Misc checks

These are all valid and make sense:
• Forbidden sensitive files:

location ~ ^/(.user.ini|.htaccess|.git|.env|.svn|.project|LICENSE|README.md) {
return 404;
}

•	Deny .ht*:

location ~ /.ht {
deny all;
}

•	error_page 404 /index.php; is fine with your location / { try_files ... }.
•	rewrite rules under @rewriteapp look okay and typical for phpMyFAQ-style routing.

⸻

Slightly cleaned-up version (core changes)

Here’s a trimmed version showing the essential fixes:

SSL

ssl_certificate /www/server/panel/vhost/cert/xxxxxxxxxx.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/xxxxxxxxxx.com/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_tickets on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
error_page 497 https://$host$request_uri;

禁止访问文件

location ~ ^/(.user.ini|.htaccess|.git|.env|.svn|.project|LICENSE|README.md) {
return 404;
}

SSL证书验证目录允许访问

location ^~ /.well-known/ {
allow all;
}

if ($uri ~ "^/.well-known/.*.(php|jsp|py|js|css|lua|ts|go|zip|tar.gz|rar|7z|sql|bak)$") {
return 403;
}

Fonts with CORS

location ~* .(eot|ttf|woff|woff2|svg)$ {
add_header Access-Control-Allow-Origin "*";
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

JS

location ~* .js$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

CSS

location ~* .css$ {
expires 1y;
add_header Cache-Control "public, max-age=31536000, immutable";
}

Images / video / pdf

location ~* .(jpg|jpeg|gif|png|webp|ico|mp4|webm|mpeg|pdf)$ {
expires 1y;
add_header Cache-Control "public";
}

主站入口

location / {
index index.php;
try_files $uri $uri/ @rewriteapp;
}

... your @rewriteapp and PHP locations as-is ...

⸻

If you want, you can paste the full server { ... } block (including listen, server_name, etc.), and I’ll adjust everything in one go so you can drop it in and run nginx -t without surprises.

[thorsten]

@yangqiceng did you tried it again?

[yangqiceng]

No, I really don’t know what else to do. Maybe I should try an older version?

[thorsten]

You can try 3.2 without the rewrite rules, that should work. Version 4.2 will support rewriting without special rules in the nginx configuration.