@lelutin on WordPress.org
Created ticket #36177 on Core Trac:default htaccess should include security measures