I've correct this bug adding an expire header like : location ^~ /protected-file/ { expires 30s; add_header Pragma public; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; gzip off; internal; alias /; } And my PHP headers are : header("X-Accel-Redirect: /protected-file".realpath($realpath)); header("X-Accel-Bufferingby poulphunter - Nginx Mailing List - English