Make XSLT use WP rewritten URLs too, so it can work alongside Sucuri's wp-content dir hardening.