# Deny access to any files with a .php extension in the uploads directory
# See: https://developer.wordpress.org/advanced-administration/server/web-server/nginx/#global-restrictions-file
location ~* /(?:uploads|files)/.*\.php$ {
    deny all;
}