How to prevent executing .php files in sites/default/files directory for nginx+php7.0-fpm? URL to Drupal.org article Preventing execution of untrusted PHP

By default .htaccess inside sites/default/files contains:

&lt;IfModule mod_php5.c&gt;
  php_flag engine off
&lt;/IfModule&gt;


Adding mod_php7.c version doesn't fix.

Temporary solutions are:

ProxyPassMatch ^/(.*\.php(/.*)?)$ "fcgi://127.0.0.1:9000/var/www/drupal"


And

&lt;FilesMatch \.php$&gt;
   SetHandler "proxy:fcgi://127.0.0.1:9000"
&lt;/FilesMatch&gt;


But they are not recommended and they are overrideable.

There is a Drupal Core issue for adding mod_php7.c to .htaccess, but it's only for Drupal 8 (so how is this solved in Drupal 7 then?) https://www.drupal.org/node/2455465

There is solution for Apache How to disable PHP files from being run in the sites/default/files directory? but not nginx and php7.0-fpm.

So what is the solution?

(I'm running Security Review module that reports PHPs are executable within sites/defaul/files)

Screenshots:


Permissions:

www-data:www-data 755 for dirs / 644 for files


.htaccess:

# Turn off all options we don't need.
Options None
Options +FollowSymLinks

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
&lt;Files *&gt;
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
&lt;/Files&gt;

# If we know how to do it safely, disable the PHP engine entirely.
&lt;IfModule mod_php5.c&gt;
  php_flag engine off
&lt;/IfModule&gt;

&lt;IfModule mod_php7.c&gt;
  php_flag engine off
&lt;/IfModule&gt;


I did restart nginx and php7.0-fpm.
This is what works for nginx and only targets files directory:

location ~ /files/.*\.php$ {
    return 403;
}


This is more generic and wont let any php file in a directory execute directly:

location ~ /.*/.*\.php$ {
    return 403;
}


WARNING, this is posted all over the web but only works for hidden directories:

location ~ \..*/.*\.php$ {
    return 403;
}