.htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# Disable XML-RPC - Security > Settings > WordPress Tweaks > XML-RPC
<files xmlrpc.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</files>

<files .env>
order allow,deny
deny from all
</files>

<files .env.sample>
order allow,deny
deny from all
</files>

<files wp-config.php>
order allow,deny
deny from all
</files>

<files .htaccess>
order allow,deny
deny from all
</files>

<files composer.json>
order allow,deny
deny from all
</files>

<files composer.lock>
order allow,deny
deny from all
</files>

<files docker-compose.yml>
order allow,deny
deny from all
</files>

<files global.json>
order allow,deny
deny from all
</files>

<files Makefile>
order allow,deny
deny from all
</files>