Secure Apache WordPress Root Directory using your Apache vhost config file instead of .htaccess by using this RegEx for file-name exclusions' i.e. (wp-activate|wp-mail|wp-signup) and {wp-} for all WordPress root files' starting with {wp-}.
Excluding wp-activate.php, wp-signup.php and wp-mail.php from Apaches' FileMatch denied 403 Forbidden Access response.
Require all denied
Excluding none (the word none is just RegEx place holder) from Apaches' FileMatch denied 403 Forbidden Access response.
Require all denied