Prevent access to WP Admin and wp-login.php via .htaccess, but allow access to admin-ajax.php

.htaccess

# Prevent WP Admin from being accessed (except admin-ajax.php)
#RewriteCond %{HTTP_HOST} ^(|www\.)yourdomain\.(com|net|org)$ [NC] # This line is optional, but useful if you only want to apply the rules to certain domains
RewriteCond %{REQUEST_URI} ^/wp-admin/ [NC]
RewriteCond %{REQUEST_URI} !^/wp-admin/admin-ajax\.php$ [NC]
RewriteRule (.*) %{REQUEST_SCHEME}://%{HTTP_HOST}/ [L,R=301]

# Prevent the WP login form from being accessed
#RewriteCond %{HTTP_HOST} ^(|www\.)yourdomain\.(com|net|org)$ [NC] # This line is optional, but useful if you only want to apply the rules to certain domains
RewriteCond %{REQUEST_URI} ^/wp-login\.php$ [NC]
RewriteRule (.*) %{REQUEST_SCHEME}://%{HTTP_HOST}/ [L,R=301]