wordpress: Deny /wp-includes/(.*).php to reduce PHP error log noise

Follows-up ce392b9.

I mistook `^~` as a higher priority prefix-based regex,
but is actually just a higher priority plain text prefix,
which means one of these didn't match.

Author: Krinkle

modules/wordpress/templates/site/site.nginx.erb

@@ -1,3 +1,11 @@
+#
+# Selection order:
+# * location =        # exact
+# * location ^~       # longest prefix (priority)
+# * location ~ or ~*  # first regex match (~* is case-insensitive)
+# * location /        # longest prefix (fallback)
+#
+# Ref https://www.digitalocean.com/community/tutorials/understanding-nginx-server-and-location-block-selection-algorithms#how-nginx-chooses-which-location-to-use-to-handle-requests
 server {
   listen 443 ssl;
   listen [::]:443 ssl;
@@ -16,28 +24,45 @@ server {
   log_not_found off;
   server_tokens off;
 
-  # Prevent hidden "dotfiles" from being served
-  location ~ /\. {
+  location = /favicon.ico {
     access_log off;
-    deny all;
+    try_files /wp-content/themes/<%= @active_theme %>/i/favicon.ico /wp-content/themes/jquery/i/favicon.ico;
+  }
+
+  location = /robots.txt {
+    access_log off;
+    try_files $uri /wp-content/themes/<%= @active_theme %>/robots.txt;
   }
 
   # Avoid noise in PHP error logs from bots accessing includes
   #
-  # > Uncaught Error: Call to undefined function __()
+  # > Error: Call to undefined function
   # > in /srv/wordpress/sites/jquery_com/wp-admin/includes/file.php
   #
   # https://core.trac.wordpress.org/ticket/9185
-  location ^~ /wp-includes/(.*).php {
+  location ^~ /wp-admin/includes/ {
     access_log off;
     deny all;
   }
-  location ^~ /wp-admin/includes/ {
+
+  include /etc/nginx/wordpress-subsites/<%= @host %>.d/*.conf;
+
+  # Prevent hidden "dotfiles" from being served
+  location ~ /\. {
     access_log off;
     deny all;
   }
 
-  include /etc/nginx/wordpress-subsites/<%= @host %>.d/*.conf;
+  # Avoid noise in PHP error logs from bots accessing includes
+  #
+  # > Error: Call to undefined function
+  # > in /srv/wordpress/sites/jquerymobile/wp-includes/customize/class-wp-customize-cropped-image-control.php
+  #
+  # NOTE: Must not deny /wp-includes/ by prefix because WordPress serves JS/CSS from here.
+  location ~ /wp-includes/(.*).php {
+    access_log off;
+    deny all;
+  }
 
 <%- if @gilded_wordpress -%>
   # Avoid matching /resources/ itself as that can be a real page
@@ -47,29 +72,19 @@ server {
   }
 <%- end -%>
 
-  location = /favicon.ico {
-    access_log off;
-    try_files /wp-content/themes/<%= @active_theme %>/i/favicon.ico /wp-content/themes/jquery/i/favicon.ico;
-  }
-
-  location = /robots.txt {
-    access_log off;
-    try_files $uri /wp-content/themes/<%= @active_theme %>/robots.txt;
-  }
-
   location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
     expires 24h;
   }
 
-  location / {
-    try_files $uri $uri/ /index.php$is_args$args;
-  }
-
   location ~ \.php$ {
     client_max_body_size 25M;
     try_files            $uri =404;
     fastcgi_pass         unix:/run/php/php<%= @php_fpm_version %>-fpm.sock;
     fastcgi_param        SCRIPT_FILENAME $request_filename;
     include              /etc/nginx/fastcgi_params;
   }
+
+  location / {
+    try_files $uri $uri/ /index.php$is_args$args;
+  }
 }