says this should be included in the .htaccess file to block requests for files inside the includes dir.
# Block the include-only files. <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L] </IfModule> # BEGIN WordPress ...
How does that work ? As far as I can read it, it only specifies not to rewrite certain urls (using -), and then fails to actually rewrite all other requests. Is there something missing ?