server {
    listen 80 default_server;
    root /var/www/html;
    index index.php;

    include /etc/nginx/snippets/security.conf;

    # WordPress pretty permalinks.
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include /etc/nginx/snippets/fastcgi-php.conf;
        fastcgi_pass fpm:9000;
    }

    # Never execute PHP uploaded into wp-content/uploads (blunts upload RCE).
    location ~* /wp-content/uploads/.*\.php$ {
        deny all;
    }

    # Reduce attack surface / noise.
    location = /xmlrpc.php { deny all; }

    # Long-cache static assets.
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
        expires 30d;
        access_log off;
    }
}