nginx map example to block direct access in wordpress files (not tested)

nginx-map.md

in a new file in /etc/nginx/conf.d

valid_referers none blocked server_names;

map $http_cookie $cookie_block {
    default 1;
    "~*wordpress_logged_in" 0;
}
map $request_uri $uri_block {
    default 0;
    "~* \.jpe?g" 1;
    "~* \.png" 1;
}
map $cookie_block$invalid_referer$request_uri $block_direct_access {
    default 1;
    000  0;
}

in your vhost

location = /wp-content/ {
    if ($block_direct_access) {
        deny all;
    }
}