globals/restrictions.conf

# Global restrictions configuration file.
# Designed to be included in any server {} block.</p>
location = /favicon.ico {
    log_not_found off;
    access_log off;
}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
    deny all;
}

# Deny access to any files with a .php extension in the uploads directory
location ~* /uploads/.*\.php$ {
    deny all;
}

# Deny access to any files with a .php extension in the uploads directory for multisite
location ~* /files/.*\.php$ {
    deny all;
}

# Since version 2.5.7, Akismet introduced a new .htaccess file to block direct access to php files
# Ref: http://wordpress.org/extend/plugins/akismet/changelog/
#location ~* /akismet/.*\.php$ {
#    allow 127.0.0.1;
#    deny all;
#}