Mistakes in the php {} part of vhost configuration files make php files to be "readable" with its source code like text files
Is there a global setting, e.g. in the default config to forbid accessing php files without fastcgi?
You could just use:
location ~ \.php$ {
deny all;
}
in case you want to make php files to be not accessible server wide or:
location ~ /path/to/dir/(.+)\.php$ {
deny all;
}
For a specific location.