加固部署配置与敏感路径拦截

nginx/nginx.conf

@@ -42,6 +42,12 @@ http {
             add_header Cache-Control "public, max-age=86400" always;
         }
 
+        location ~* (^|/)(\.git|\.env($|[./_-])|wp-config\.php|config\.php|database\.yml|backup($|[._/-])) {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location /api/ {
             proxy_pass http://backend;
             proxy_set_header Host $host;