block wordpress file uploaded php file rum

add below code to nginx .conf file.

 # block upload php files
location ~* /(?:uploads|files|wp-content|wp-includes)/.*.php$ {
deny all;
access_log off;
log_not_found off;
}