I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed directly via HTTP. For instance,
http://MYSITE/blog/xmlrpc.php needs to remain directly accessible, but there's no reason why
http://MYSITE/blog/wp-load.php shouldn't give a 404.
The question is: Where do I get a complete list of stock Wordpress .php files that can legitimately appear in URLs?
Also, I use mod_rewrite to remove the top-level
index.php from all my published URLs -- does that mean I can block direct use of