Thank you so much wfyann, yes it looks like it’s a Sucuri bug. Strange thing is that article was 7 months ago – and it still hasn’t been fixed. Infact it only cropped up on my sites over the past 2 weeks.
This is the content of the htaccess file
<FilesMatch “\.(?i:php)$”>
<IfModule !mod_authz_core.c>
Order allow,deny
Deny from all
</IfModule>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
</FilesMatch>
<Files wp-tinymce.php>
Allow from all
</Files>
<Files ms-files.php>
Allow from all
</Files>
