rm command removes specified file name from the directory entries, so you can’t see that file name after remove. But it doesn’t actually delete the file contents.
Deleting file contents is the responsibility of kernel. If deleted file has any hard links or already opened by a process, its contents not removed.
You can check a file is already opened by a process or not with
lsof command like below:
$ sudo lsof -n | grep filename
In your setup, webserver still keeps open file descriptors. If you restart the webserver, file contents will be deleted and df shows correct numbers.