# Deny access to any files with a .php extension in the uploads directory location ~* /(?:uploads|files)/.*\.php$ { deny all; } # Block PHP files in content directory. location ~* /wp-content/.*\.php$ { deny all; } # Block PHP files in includes...