wordpress_secure.conf

include /etc/nginx/wordpress/disable_user_api.conf;
rewrite /wp-admin$ $scheme://$host$uri/ permanent;

location /wp-includes/{
    location ~ \.(gz|tar|bzip2|7z|php|php5|php7|log|error|py|pl|kid|love|cgi)$ {
        deny all;
    }
}
location /wp-content/uploads {
    location ~ \.(gz|tar|bzip2|7z|php|php5|php7|log|error|py|pl|kid|love|cgi)$ {
        deny all;
    }
}
location /wp-content/updraft {
    deny all;
}
location /wp-content/uploads/sucuri {
    deny all;
}
location /wp-content/uploads/nginx-helper {
    deny all;
}
location = /wp-config.php {
    deny all;
}
location = /wp-links-opml.php {
    deny all;
}
location = /wp-config-sample.php {
    deny all;
}
location = /wp-comments-post.php {
    deny all;
}
location = /readme.html {
    deny all;
}
location = /license.txt {
    deny all;
}

# enable gzip on static assets - php files are forbidden
location /wp-content/cache {
# Cache css & js files
    location ~* \.(?:css(\.map)?|js(\.map)?|.html)$ {
        add_header Access-Control-Allow-Origin *;
        access_log off;
        log_not_found off;
        expires 97d;
    }
    location ~ \.php$ {
        #Prevent Direct Access Of PHP Files From Web Browsers
        deny all;
    }
}