Block accessto WordPress directory and files

nginx.conf

location = ~* /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}
location = ~* /wp-config.php {
    deny all;
    log_not_found off;
}

location ~* /wp-includes/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;
}

location ~* /wp-content/.*.php$ {
    deny all;
    access_log off;
    log_not_found off;
}

location ~* /(?:uploads|files)/.*.php$ {
   deny all;
   access_log off;
   log_not_found off;
}