This modified version of Bill Erickson's .gitignore file for Wordpress differs in that I chose to include all plugins so I can quickly use Git to see whether any have been infected by malware. I also added the .vscode folder to the ignore list, and changed "ehthumbs.db" to "thumbs.db", which was likely the original intention.

.gitignore

# Ignore everything except plugins... #
**
!wp-content/
wp-content/**
!wp-content/themes/
wp-content/themes/**
!wp-content/plugins/
!wp-content/plugins/**
!wp-content/mu-plugins/
!wp-content/mu-plugins/**

# ...and this custom theme
!wp-content/themes/industry-road-custom/
!wp-content/themes/industry-road-custom/**

# Add two rules for each theme you want to include:
# 1. !folder-name/    <-- includes the top level files
# 2. !folder-name/**  <-- includes the sub level files recursively, except for the "Ignore some other system generated files" rules below

############################################
# Ignore some other system generated files #
############################################
*.com
*.class
*.dll
*.exe
*.o
*.so
*.7z
*.dmg
*.gz
*.iso
*.jar
*.rar
*.tar
*.log
*.sql
*.sqlite
.DS_Store
._*
.Spotlight-V100
.Trashes
Thumbs.db
thumbs.db
.codekit-cache
.sass-cache
# Sublime
*.sublime-project
*.sublime-workspace
# PhpStorm
.idea/
# Visual Studio Code
.vscode/

# Always include the build script #
###################################
!build.sh
!README.md
!CHANGELOG.md
!.gitignore