diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf
index 8d0d685..146e49b 100644
--- a/docker/nginx/nginx.conf
+++ b/docker/nginx/nginx.conf
@@ -71,6 +71,12 @@ http {
         error_page 404 /index.php;
 
         location ~ \.php$ {
+            # A .php request that is NOT a real file (e.g. an attacker probing /wp-login.php,
+            # /xmlrpc.php, /admin.php, /vendor/…/eval-stdin.php) must reach Laravel (the honeypot
+            # route) instead of returning php-fpm's "File not found" 404. Only index.php actually
+            # exists in public/, so this executes solely the front controller; every other .php
+            # falls through to /index.php and is routed by the app.
+            try_files $uri /index.php?$query_string;
             fastcgi_pass 127.0.0.1:9000;
             fastcgi_index index.php;
             include fastcgi_params;