How to hide .user.ini in my NGINX server to use Wordfence in Wordpress?

Hi @hcmendez:

You can make Nginx drop all requests to the file .user.ini by returning a HTTP 400 status code (or any other error code of your choice). Add the following to the Nginx server block for your WordPress site:

    location = /.user.ini { return 400; }

This location block should be at the same level as other existing location blocks.

Then your server block should look like this:

server {
...
    server_name yoursite.com;
...
    location = /.user.ini { return 400; }
...
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }
....
}