Managing a secure website becomes much easier when important files are properly protected from direct access. A good example is to protect wp-config.php as part of your security setup. https://rankmywp.medium.com/the-one-wordpress-file-that-hands-over-the-whole-site-2427d02cf686