better wordpress .htaccess

.htaccess

<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|swf|xml|txt|css|js|svg|html|htm|hbs|json|map|woff|ttf|webp)$">
    RewriteBase /
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
</FilesMatch>
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^xmlrpc\.php$ / [R=302,L]
RewriteRule ^wp-admin.*$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_FILENAME} !-d [OR]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d [OR]
RewriteRule . /index.php [L]

Disable XMLRPC entirely. Limit access to what WordPress PHP files can be called.

I will turn this into a script to analyze the actual wp-admin directory from LTS