Hi,
would like to add for .htaccess
Block access to wp-login.php which works great if you want to prevent adding any new user or admin.
<Files wp-login.php>
Deny from all
</Files>
btw, this way you can block access to any file if your wordpress firewall shows attacks on the specific files.
Cheers
Dan