In reply to mark k..

@Stephen, basically block php execution on everything which is under wp-content. This will block direct access to plugin an theme code and will have the added value of preventing execution on the open to write directory of uploads.

but yeh, I forgot about wp-admin so root+wp-admin should be open, and probably no harm in keeping wp-includes open to execution although it is probably not needed.