WordPress Security .htaccess

.htaccess

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

<IfModule mod_headers.c>
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options DENY
Header always set X-Download-Options: noopen
Header always set X-Powered-By: ""
</IfModule>

<IfModule mod_php5.c>
php_flag session.cookie_httponly on
php_flag session.cookie_secure On
</IfModule>

<Files wp-config.php>
order allow,deny
deny from all
</Files>

Options -Indexes

<Files ~ "^.(htpasswd|htaccess)$">
deny from all
</Files>
DirectoryIndex index.html .ht
DirectoryIndex index.htm .ht
DirectoryIndex index.php .ht