Mod rewrite rule to disallow direct acccess to files from some directory

Hello, in wordpress is wp-includes folder, i dont want anyone just execute file from this directory so it just serve wordpress not any malicious file be executed from there,

so i added this rule into /wp-includes/.htaccess:

But it appears someone injected spam mailing php script into /wp-includes/js/tinymce/plugins/wplink

So i want to ask how i need to tweak my rewrite rule so it includes all wp-includes subdirectories?

Thank you

 

Disallow anyone access to this folder and subfolder in wp-includes ???
Did you try Order deny allow ???

 

that made my wp non function properly