Code for a blog post at https://www.pmg.com/blog/composer-and-wordpress/

.htaccess

RewriteEngine on
RewriteRule ^composer\.(lock|json)$ - [F,L]
RewriteRule ^vendor/.*$ - [F,L]

composer.json

{
    "name": "pmg/composer-wp-example",
    "description": "Getting start with WordPress and Composer",
    "license": "MIT",
    "repositories": [
        {
            "type":"composer",
            "url":"http://wpackagist.org"
        }
    ],
    "require": {
        "php": ">=5.5",
        "johnpbloch/wordpress-core-installer": "0.2.0",
        "johnpbloch/wordpress": "~4.2",
        "composer/installers": "~1.0",
        "wpackagist-plugin/wordpress-seo": "~2.1"
    },
    "extra": {
        "wordpress-install-dir": "wp",
        "installer-paths": {
            "content/plugins/{$name}": ["type:wordpress-plugin"],
            "content/themes/{$name}": ["type:wordpress-theme"],
            "content/mu-plugins/{$name}": ["type:wordpress-muplugin"]
        }
    }
}

composer_barebones.json

{
    "name": "pmg/composer-wp-example",
    "description": "Getting start with WordPress and Composer",
    "license": "MIT",
    "require": {
        "php": ">=5.5",
        "johnpbloch/wordpress-core-installer": "0.2.0",
        "johnpbloch/wordpress": "~4.2"
    },
    "extra": {
        "wordpress-install-dir": "wp"
    }
}

composer_repos.json

{
    "name": "pmg/composer-wp-example",
    "description": "Getting start with WordPress and Composer",
    "license": "MIT",
    "repositories": [
        {
            "type":"composer",
            "url":"http://wpackagist.org"
        }
    ],
    "require": {
        "php": ">=5.5",
        "johnpbloch/wordpress-core-installer": "0.2.0",
        "johnpbloch/wordpress": "~4.2",
        "composer/installers": "~1.0"
    },
    "extra": {
        "wordpress-install-dir": "wp",
        "installer-paths": {
            "content/plugins/{$name}": ["type:wordpress-plugin"],
            "content/themes/{$name}": ["type:wordpress-theme"],
            "content/mu-plugins/{$name}": ["type:wordpress-muplugin"]
        }
    }
}

nginx_blocks.conf

server {
  host yoursite.com
  
  # ...
  
  location ~ ^/composer\.(json|lock) {
    return 401;
  }
  
  location /vendor {
    return 401;
  }
 }