ServerTokens Prod
ServerSignature Off
TraceEnable Off

<LocationMatch "^/wp-content/(uploads|files)/.*\.php$">
    Require all denied
</LocationMatch>

<LocationMatch "^/wp-config\.php$">
    Require all denied
</LocationMatch>

<LocationMatch "^/wp-admin/includes/">
    Require all denied
</LocationMatch>

<LocationMatch "^/wp-includes/[^/]+\.php$">
    Require all denied
</LocationMatch>

<LocationMatch "^/wp-includes/js/tinymce/langs/.+\.php$">
    Require all denied
</LocationMatch>

<LocationMatch "^/wp-includes/theme-compat/">
    Require all denied
</LocationMatch>