Well it depends what type of attacks you are trying to block. You can modify your PHP.ini to block some attacks by changing the values of
allow_url_include = "0"
allow_url_fopen = "0"
Disable Dangerous functions in PHP if you dont need them
disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,shell_exec,proc_open,popen,system,exec,
Also and probably more important is to use open_basedir to block remote attacks on system files, this allows your code to only open files in specific directories protecting sensitive system files.
If using Nginx block scripts from being run in upload directories
location ~ /gallery/(.+)\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)$ {
deny all;
}
location ~ /uploads/(.+)\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)$ {
deny all;
}
location ~ /downloads/(.+)\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)$ {
deny all;
}
location ~ /files/(.+)\.(php|cgi|pl|php3|php4|php5|php6|phtml|shtml)$ {
deny all;
}
There are many other ways to tweak and protect your serer and applications but most importantly keep it updated with the latest security fixes