How to prevent direct http requests into folder, but allow incuding folder files?

Hello, at https://codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
I read that: "common attacks against a WordPress blog usually fall into"

Sending specially-crafted HTTP requests to your server with specific exploit payloads for […]

See original post by invalid@example.com (postcd)