Please append this to your /.htaccess (the file in the root folder)

## WP Defender - Prevent information disclosure ##
<FilesMatch "\.(txt|md|exe|sh|bak|inc|pot|po|mo|log|sql)$">
Order allow,deny
Deny from all
</FilesMatch>
## WP Defender - End ##

Inside your /wp-content/.htaccess, please add this

## WP Defender - Prevent PHP Execution ##
<Files *.php>
Order allow,deny
Deny from all
</Files>
## WP Defender - End ##

And lastly, inside your wp-includes/.htaccess

## WP Defender - Prevent PHP Execution ##
<Files *.php>
Order allow,deny
Deny from all
</Files>
<Files wp-tinymce.php>
Allow from all
</Files>
<Files ms-files.php>
Allow from all
</Files>
## WP Defender - End ##

This is a standard feature in all the WordPress security plugins.

Defender check if the rules applied properly by firing a request to a URL. Example, if you placed the Prevent PHP Execution rule, then when you access this URL
http://domain.com/wp-includes/wp-db.php
You will get a 403 error, if you can access that URL after placed the rule. Then it might be your web browser doesn’t get config to allow override by htaccess.