using .htaccess only for wordpress security no plugins

Yes, you can use a htaccess.

In fact, I often recommend htaccess based protections over plugins because they do not depend upon PHP code or WordPress. The use a completely independent system – Apache.

The more important question is:

Do your htaccess rules protect against the threats you with to
mitigate?

Some protections may require a plugin simply because the functionality is not available through what Apache offers.

For example, many plugins attempt to block brute force attacks against your WordPress Login.

You can also achieve the same result by using HTTP Authentication.

Similarly, some plugins try to protect against code-injection, but you can also do this with Apache’s mod_rewrite.