pfSense

If a user tries to directly access a file ending in .inc, the browser will offer to download the file. There are no .inc files containing secrets (it's all on github), so this is primarily a safety belt.

Seems easy to block without harming anything by adding a section like this above the php location directive in the nginx config:

        location ~ \.inc$ {
            deny all;
            return 403;
        }

I don't see any other file types under /usr/local/www/ that should be blocked, everything else appears to be web assets as expected.