I’m finding this is still an issue… when wp-includes is set to hardened, using WP 4.3.1, in the browser console it reports a 404 for the file:
/wp-includes/js/tinymce/wp-tinymce.php?c=1&ver=4205-20150910
/wp-includes/js/tinymce/wp-tinymce.php by itself returns a 404 as well.
and then the error:
Uncaught ReferenceError: tinymce is not defined
If I deactivate all plugins, and revert to the 2015 theme, it still happens. If I delete the .htaccess file that the Sucuri plugin creates, it starts working again.
Apparently the wp-tinymce.php exception is not working for some reason.
Here’s what to include according to the Codex Hardening page, and I’ve tested that it does work:
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
Hope that helps someone.
~ Rob
PressWizards.com