nginx.conf

server {
    #listen 80;
    index index.html index.php;

    ## Begin - Server Info
    root /home/USER/www/html;
    server_name localhost;
    ## End - Server Info

    ## Begin - Index
    # for subfolders, simply adjust:
    # `location /subfolder {`
    # and the rewrite to use `/subfolder/index.php`
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    ## End - Index

    ## Begin - Security
    # deny all direct access for these folders
    location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
    # deny all direct access to these sensitive user folders, whatever the file type
    location ~* /user/(config|env)/.*$ { return 403; }
    # allow avatar images under user/accounts to be served directly, whether stored
    # at user/accounts/avatars/<file> (flatfile accounts) or user/accounts/<username>/
    # <file> (Flex folder storage); this must come before the user/accounts deny so it
    # wins the first-match. SVG is intentionally excluded as a stored-XSS vector.
    location ~* /user/accounts/[^/]+/[^/]+\.(jpe?g|png|gif|webp|avif|bmp|ico)$ { try_files $uri =404; }
    # deny everything else under user/accounts, whatever the file type
    location ~* /user/accounts/.*$ { return 403; }
    # allow public media uploads under user/data (e.g. Flex Object images) to be
    # served directly; this must come before the user/data deny so it wins the
    # first-match. SVG is intentionally excluded as a stored-XSS vector.
    location ~* /user/data/.*\.(jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf)$ { try_files $uri =404; }
    # deny everything else under user/data, whatever the file type
    location ~* /user/data/.*$ { return 403; }
    # deny running scripts inside core system folders
    location ~* /(system|vendor)/.*\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
    # deny running scripts inside user folder
    location ~* /user/.*\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
    # deny access to specific files in the root folder
    location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
    # deny access to .env environment files
    location ~ /\.env(\.|$) { return 403; }
    ## End - Security

    ## Begin - PHP
    location ~ \.php$ {
        # Choose either a socket or TCP/IP address
        fastcgi_pass unix:/var/run/php/php-fpm.sock;
        # fastcgi_pass unix:/var/run/php5-fpm.sock; #legacy
        # fastcgi_pass 127.0.0.1:9000;

        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    }
    ## End - PHP
}