Why is this line of code Wrong in every WordPress .Htaccess security article?

is partly wrong in every WordPress .Htaccess hardening article I’ve seen.

Unfortunately it is very common for Apache config/regex code snippets to be blindly copy/pasted and errors do propagate. Unless there is some obscure vulnerability we are not aware of then I would bet that that is what has happened here. (Although matching “too much” is not necessarily a problem here.)

Although per-directory php.ini files (in the public HTML space) is not a common scenario these days, so this check is arguably bogus anyway. However, .user.ini files are, so this should probably be added (ie. \.user\.ini).

And error_log, php.ini and .htaccess / .htpasswd files are not specific to WordPress.

However, there are other potential “errors” with the code snippet:

• The ^.* prefix on the regex is entirely superfluous and just makes the regex a little less efficient. However, the effect of this is that the remainder of the regex is essentially just a suffix. In other words, it will match <anything>error_log, <anything>wp-config.php, <anything>php<anychar>ini and <anything>.[hH][tT][aApP]<anything>. Which is probably unnecessary.

• The directives Order and Deny are Apache 2.2 directives and formerly deprecated on Apache 2.4, which is more likely what you are using these days. These directives have been moved to an optional extension (mod_access_compat) which might not even be installed. On Apache 2.4 you should be using the equivalent Require directive instead:

  Require all denied
  

  But note that you should not mix old and new auth directives in the same config as you can get unexpected results due to the order in which these directives are processed.