Securing wp-includes

Hello!
There is an article about hardening WordPress (https://ww.wp.xz.cn/support/article/hardening-wordpress/#securing-wp-includes).

The article recommends adding some code to the .htaccess file outside the “# BEGIN WordPress” to secure “wp-includes”:

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# BEGIN WordPress

In the code that is automatically generated by your plugin I did not find these lines of code.
Do I have to add this code manually in the .htaccess file after the code generated by your plugin?
For example, like this:

# BEGIN All In One WP Security
...some autogenerated code by your plugin
# END All In One WP Security

# Block the include-only files.
...manually adding the code from the article above to secure wp-includes

# BEGIN WordPress
...standart wordpress code
# END WordPress

Or does your plugin already include securing of the “wp-includes” folder with some other equivalent way and I do not have to add the code manually?

Thank you

• This topic was modified 5 years, 1 month ago by Sergey.