location ~* /(?:uploads|files|wp-content|wp-includes)/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;
}