diff --git a/config/nginx.sample.conf b/config/nginx.sample.conf
index 39a02ef6324..434a3ec88b1 100644
--- a/config/nginx.sample.conf
+++ b/config/nginx.sample.conf
@@ -58,6 +58,11 @@ server {
   # further more etags are based on the file in nginx not sha of data
   # use dates, it solves the problem fine even cross server
   etag off;
+  
+  # prevent direct download of backups
+  location ^~ /backups/ {
+    internal;
+  }
 
   location / {
     root $public;