If your file-system permissions aren’t set up correctly, most of your security measures could be easily bypassed by intruders

One of the most important things you can make is to protect your .htaccess file along with your error logs, wp-config.php and php.ini files. Once you make the following change, attempts to access these files are denied.