djeraseit/debian-server-tools/master/webserver/apache-conf-available/worpress-htaccess/site/wp-includes/.htaccess
# NO wp-includes PHP
# deny first
<Files "*.php">
# Apache < 2.3
<IfModule !mod_authz_core.c>
Order Allow,Deny
Deny from all
Satisfy All
</IfModule>
# Apache ≥ 2.3
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
</Files>
# Whitelist ms-files.php
<Files ms-files.php>
# Apache < 2.3
<IfModule !mod_authz_core.c>
Order Deny,Allow
Allow from all
Satisfy All
</IfModule>
# Apache ≥ 2.3
<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</Files>
On Github License
Files