How to prevent executing .php files in sites/default/files directory for nginx+php7.0-fpm?
This is what works for nginx and only targets files directory:

location ~ /files/.*\.php$ {
    return 403;
}


This is more generic and wont let any php file in a directory execute directly:

location ~ /.*/.*\.php$ {
    return 403;
}


WARNING, this is posted all over the web but only works for hidden directories:

location ~ \..*/.*\.php$ {
    return 403;
}