djeraseit/debian-server-tools/master/webserver/apache-conf-available/worpress-htaccess/site/wp-includes/.htaccess

# NO wp-includes PHP
# deny first
<Files "*.php">
    # Apache < 2.3
    <IfModule !mod_authz_core.c>
        Order Allow,Deny
        Deny from all
        Satisfy All
    </IfModule>
    # Apache ≥ 2.3
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</Files>
# Whitelist ms-files.php
<Files ms-files.php>
    # Apache < 2.3
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Allow from all
        Satisfy All
    </IfModule>
    # Apache ≥ 2.3
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</Files>