Disable PHP file execution
http://www.wpbeginner.com/wordpress-security/#fileexecution <Files *.php> deny from all </Files>