NGINXConfig defaults break s2Member functions

[B-Interactive]

EXPLANATION OF THE ISSUE

The NGINXConfig tool generates secure and performant config files for Nginx, based on standard best practice. It provides the following WordPress specific config for Nginx:

# WordPress: allow TinyMCE
location = /wp-includes/js/tinymce/wp-tinymce.php {
    include nginxconfig.io/php_fastcgi.conf;
}

# WordPress: deny wp-content, wp-includes php files (BREAKS S2 STYLES)
location ~* ^/(?:wp-content|wp-includes)/.*\.php$ {
    deny all;
}

# WordPress: deny wp-content/uploads nasty stuff
location ~* ^/wp-content/uploads/.*\.(?:s?html?|php|js|swf)$ {
    deny all;
}

# WordPress: SEO plugin
location ~* ^/wp-content/plugins/wordpress-seo(?:-premium)?/css/main-sitemap\.xsl$ {}

# WordPress: deny wp-content/plugins (except earlier rules) (BREAKS S2 STYLES)
location ~ ^/wp-content/plugins {
    deny all;
}

# WordPress: deny general stuff
location ~* ^/(?:xmlrpc\.php|wp-links-opml\.php|wp-config\.php|wp-config-sample\.php|readme\.html|license\.txt)$ {
    deny all;
}

Two of these rulesets break s2Member's ability to execute functions. In my tests, it throws ERR ABORTED 403 on access to these and I would expect others:
/wp-content/plugins/s2member/s2member-o.php?ws_plugin__s2member_css...
/wp-content/plugins/s2member/s2member-o.php?ws_plugin__s2member_js_w_globals...

The end result is a janky looking payment page, with broken menu items and PayPal features. I'm still trying to figure out the extent of it.

STEPS TO REPRODUCE THE ISSUE

Gotta be using Nginx, and include either of these two rulesets in its config file:

# WordPress: deny wp-content/plugins (except earlier rules)
location ~ ^/wp-content/plugins {
    deny all;
}

# WordPress: deny wp-content, wp-includes php files
location ~* ^/(?:wp-content|wp-includes)/.*\.php$ {
    deny all;
}

Then, visit the sign-up page on a WordPress + s2Member based website and monitor the console output for errors.

BEHAVIOR THAT I EXPECTED

No conflict with standard best practice rulesets, and an unbroken membership page.

BEHAVIOR THAT I OBSERVED

Layout of our membership page appeared janky. PayPal icon missing, with strange features in its place. It's also asking for credit card details in a place it shouldn't (outside of PayPal).

WORKAROUND

Pretty obviously, the two rulesets causing the issue can be removed or commented out.