Rather than rehash all the information, let me point you in the direction of this great blog post:
http://ethitter.com/2013/04/protecting-wp-login-in-nginx/
If you have problems with wp-login.php being downloaded to the user then your PHP configuration using this tutorial is wrong. See this article I wrote about it:
http://deanclatworthy.com/2013/02/migrating-from-apache-to-nginx-wordpress-edition/
