boban 1b3e058de6 fix(honeypot): route non-existent .php probes through nginx to the trap ... nginx's `location ~ \.php$` fastcgi-passed EVERY .php path to php-fpm, which 404'd the classic attacker probes (/wp-login.php, /xmlrpc.php, /admin.php, /vendor/…/eval-stdin.php) with 'File not found' BEFORE they could reach the Laravel honeypot route — so those decoys never trapped behind nginx (the feature tests hit the Laravel route directly, bypassing nginx, and missed this). Add `try_files $uri /index.php?$query_string` to the php location so a non-existent .php falls through to the front controller (only index.php actually exists in public/, so nothing else executes). Verified through nginx: all .php + non-.php + dotfile decoys now serve the deceptive 200.		2026-07-05 09:32:23 +02:00
..
nginx.conf	fix(honeypot): route non-existent .php probes through nginx to the trap	2026-07-05 09:32:23 +02:00