Block PHP Files Nginx

Question

In my server block in Nginx config, I have put:

location ~* /wp-content/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;
}

However, if I manually enter in a web browser:

https://www.example.com/wp-content/themes/mytheme/functions.php

The file is still executed. What am i missing?

Also in my wp-config I have

/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
    define('ABSPATH', dirname(__FILE__) . '/');

Is this related and/or required?

Answer 1

Ok found the answer. You need to put this directive above the location:

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

The order apparently matters inside the nging conf file.