Locking down the wp-includes directory that you mentioned is a good step to prevent public access. For additional security, use the rule RewriteRule ^...