File access protection for WordPress