# Block malware files
location ~ /(l\.php|about\.php|radio\.php|lock360\.php|system_log\.php|adminfuns\.php)$ {
    deny all;
    return 404;
}

# Block suspicious folders
location ~ /(d[0-9]{7}|f[0-9a-f]{5}|[0-9]{6,})/ {
    deny all;
    return 404;
}

# Block wp-cron.php from direct access (use system cron instead)
location = /wp-cron.php {
    deny all;
    return 404;
}