In addition to the above, you need to lock down access to the various wp* files and directories. If someone wanted to see if you were running WP they could guess to see if you had wp-settings.php or if they could access some directory. Returning a 403 isn't sufficient because it tells the user that the resource exists; they just don't have access to it.

I'm not an apache expert so I asked this question over on serverfault.

In addition to the above, you need to lock down access to the various wp* files and directories. If someone wanted to see if you were running WP they could guess to see if you had wp-settings.php or if they could access some directory. Returning a 403 isn't sufficient because it tells the user that the resource exists; they just don't have access to it.

I'm not an apache expert so I asked this question over on serverfault.