add below code to nginx .conf file.
# block upload php files
location ~* /(?:uploads|files|wp-content|wp-includes)/.*.php$ {
deny all;
access_log off;
log_not_found off;
} add below code to nginx .conf file.
# block upload php files
location ~* /(?:uploads|files|wp-content|wp-includes)/.*.php$ {
deny all;
access_log off;
log_not_found off;
}