diff --git a/.docker/wordpress-nginx/default.conf b/.docker/wordpress-nginx/default.conf
index 4899d9d..903684f 100644
--- a/.docker/wordpress-nginx/default.conf
+++ b/.docker/wordpress-nginx/default.conf
@@ -22,6 +22,10 @@ server {
         try_files $uri $uri/ /index.php$is_args$args;
     }
 
+    location ~* ^/wp-content/.*/vendor(-bin)?/.*\.php$ {
+        deny all;
+    }
+
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;