location ~ /\.ht {
    deny all;
}

location ~* /(?:uploads|files)/.*\.php$ {
    deny all;
}

location ~* ^/wp-content/.*\.(php|phps)$ {
    deny all;
}

location ~* ^/wp-includes/.*\.php$ {
    deny all;
}

location = /xmlrpc.php {
    deny all;
}