diff --git a/roles/matomo/templates/matomo-nginx.conf.j2 b/roles/matomo/templates/matomo-nginx.conf.j2
index 8ec494bc0..a5fdce030 100644
--- a/roles/matomo/templates/matomo-nginx.conf.j2
+++ b/roles/matomo/templates/matomo-nginx.conf.j2
@@ -1,3 +1,5 @@
+location ~ ^/matomo/(config|tmp|core|lang) { deny all; return 403; }
+
 location ~ ^/matomo(.*)\.php(.*)$ {
     alias /library/www/matomo$1.php$2;    # /library/www/matomo
     proxy_set_header X-Real-IP  $remote_addr;
@@ -10,7 +12,6 @@ location ~ ^/matomo(.*)\.php(.*)$ {
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param SCRIPT_NAME     $fastcgi_script_name;
     fastcgi_param PATH_INFO       $2;
-    location ~ ^/matomo/(config|tmp|core|lang) { deny all; return 403; }
 }
 
 location ~ ^/matomo(/)? {