Hide wp-includes, wp-content, and wp-uploads From Showing on the Browser (Disable Directory Browsing)
You may have noticed that you can see what files your website has just by going to a certain URL of your website. Try going to yourwebsite.com/wp-includes/js/jquery/.
If the page looks like the one below, then you'll want to disable directory browsing.
If you don’t disable it, malicious individuals can find out what kind of themes and plugins you have and based on that information, they can use known exploits for these items to hack into your website.
Thankfully, disabling directory browsing is very simple.
In your website’s root directory, edit your .htaccess file and add this code at the bottom:
Options -Indexes
Save your .htaccess file and you’re good to go! After doing this try visiting the example URL earlier and you should now be greeted with a 403 forbidden error.