I know the correct way as you are saying but i have an extremely secure wordpress setup and most files are not in the public_html folder, there is a specific reason me and my friend did this. Posted at Nginx Forum: https://forum.nginx.org/read.php?2,288085,288090#msg-288090