diff --git a/readme-vars.yml b/readme-vars.yml
index 80ee096..eec5997 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -46,6 +46,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "25.12.23:", desc: "Existing users should update: site-confs/default.conf - Cleanup default site conf." }
   - { date: "06.09.23:", desc: "Add support for custom themes." }
   - { date: "25.05.23:", desc: "Rebase to Alpine 3.18, deprecate armhf." }
   - { date: "13.04.23:", desc: "Move ssl.conf include to default.conf." }
diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample
index bdddd5e..5a0cdf1 100644
--- a/root/defaults/nginx/site-confs/default.conf.sample
+++ b/root/defaults/nginx/site-confs/default.conf.sample
@@ -1,4 +1,4 @@
-## Version 2023/04/13 - Changelog: https://github.com/linuxserver/docker-phpmyadmin/commits/main/root/defaults/nginx/site-confs/default.conf.sample
+## Version 2023/12/25 - Changelog: https://github.com/linuxserver/docker-phpmyadmin/commits/main/root/defaults/nginx/site-confs/default.conf.sample
 
 map $sent_http_content_type $expires {
     default         off;
@@ -19,7 +19,7 @@ server {
     include /config/nginx/ssl.conf;
 
     root /app/www/public;
-    index index.php index.html;
+    index index.html index.htm index.php;
 
     location / {
         # enable for basic auth
@@ -28,15 +28,21 @@ server {
 
         expires $expires;
 
-        try_files $uri $uri/ /index.php$is_args$args;
+        try_files $uri $uri/ /index.html /index.htm /index.php$is_args$args;
     }
 
     location ~ ^(.+\.php)(.*)$ {
+        # enable the next two lines for http auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
+
         fastcgi_split_path_info ^(.+\.php)(.*)$;
+        if (!-f $document_root$fastcgi_script_name) { return 404; }
         fastcgi_pass 127.0.0.1:9000;
         fastcgi_index index.php;
-        fastcgi_read_timeout 3600;
         include /etc/nginx/fastcgi_params;
+
+        fastcgi_read_timeout 3600;
     }
 
     # deny access to .htaccess/.htpasswd files