cfc/docs/nginx-block-sensitive-paths.conf

# === 拒绝敏感路径扫描（减少日志噪音）===
# 放在 server {} 块内，其他 location 之前

# 环境配置文件扫描
location ~* ^/\.env {
    default_type application/json;
    return 403 '{"code":403,"message":"Forbidden"}';
}

location ~* ^/api/\.env {
    default_type application/json;
    return 403 '{"code":403,"message":"Forbidden"}';
}

# Spring Boot Actuator
location ~* ^/actuator {
    default_type application/json;
    return 404 '{"code":404,"message":"Not Found"}';
}

# Git 文件泄露
location ~* ^/\.git {
    default_type application/json;
    return 403 '{"code":403,"message":"Forbidden"}';
}

# 常用扫描路径（返回 404 伪装不存在）
location ~* ^/(admin|wp-admin|wp-content|wp-includes|xmlrpc|phpmyadmin|pma|manager|console|debug|swagger|api-docs|docs)(/|$) {
    return 404;
}

# 通用：以点开头的隐藏文件
location ~* /\.(?!well-known) {
    default_type application/json;
    return 403 '{"code":403,"message":"Forbidden"}';
}