nginx – Blocking access to `*.php` in `.well-known`

The first idea might be to use nested locations like this:

location ^~ /.well-known/ {
    . . .
    location ~ \.php$ {
        deny all;
    }
}

However, the documentation gives a hint why this might fail:

location blocks can be nested, with some exceptions mentioned below.

If the longest matching prefix location has the “^~” modifier then
regular expressions are not checked.

To circumvent this, you would need to remove the ^~ modifier and add a regex location that matches .php in /.well-known/.

location /.well-known/ {
    . . .
}

location ~ ^/.well-known/.*\.php$ {
    deny all;
}

location ~ \.php$ {
    . . .
}