Improve WP Security

wordpress-security.htaccess

RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

RewriteRule (vendor|node_modules) - [R=404,L,NC]
RewriteRule Gruntfile.js - [R=404,L,NC]
RewriteRule gulpfile.js - [R=404,L,NC]
RewriteRule package.json - [R=404,L,NC]
RewriteRule package-lock.json - [R=404,L,NC]
RewriteRule yarn.lock - [R=404,L,NC]
RewriteRule composer. - [R=404,L,NC]
RewriteRule phpunit - [R=404,L,NC]

Options -Indexes

<Files "wp-config.php">
Order Allow,Deny
Deny from all
</Files>

<Files "wp-config-sample.php">
Order Allow,Deny
Deny from all
</Files>

<files xmlrpc.php>
order allow,deny
deny from all
</files>

<files wp-comments-post.php>
order allow,deny
deny from all
</files>

<files readme.html>
order allow,deny
deny from all
</files>

<files license.txt>
order allow,deny
deny from all
</files>

<files wp-links-opml.php>
order allow,deny
deny from all
</files>