php-file not protected

Hello

I have a basic authentication inserted to my nginx server config.

location / {
# This is cool because no php is touched for static content.
# include the "?$args" part so non-default permalinks doesn't break when using query string
try_files $uri $uri/ /index.php?$args;
auth_basic "Admin Login";
auth_basic_user_file /etc/nginx/pma_pass;

I thought I can't reach any file in my location without an authentication. But I have 2 files in /php sub directory. One is a *.txt file and the other one *.php. The *.txt is protected and the login popup is appearing but not for the *.php-file. It will be deliverd as it is designed for. I would like to have it protected the same way as the *.txt.

Any suggestions?

Kind regards
//neph