Verification is needed that the following scripts should not be directly accessible as is currently the behaviour, or if some installs might need them to be accessible: - [x] `wp-activate.php`: *This probably does what the entrypoint script does if no database tables are found* - [x] `wp-blog-header.php` - [x] `wp-comments-post.php` - [x] `wp-load.php` - [x] `wp-mail.php` - [x] `wp-signup.php` - [x] `wp-traceback.php`