Nginx Password Protect Directory Downloads Source Code

Let me translate the current config. Whenever browser request /wp-login.php, the request only matches section location ^~ /wp-login.php, not including your php-fpm configuration. So, nginx just apply the auth_basic and then spit out the source code of wp-login.php because nginx can't parses it.

The solution is adding php-fpm section like this

    include /etc/nginx/fastcgi_params;
    fastcgi_pass unix:/var/lib/php5-fpm/web11.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_intercept_errors on;

inside your location ^~ /wp-login.php directive.

Source: Protecting The Wordpress Login In Nginx