The most safe .htaccess for modx

Hello. Please, give me a piece of advice on what .htaccess should look like in order to get the best security from it. I mean all the .htaccess files that should be on a modx site.
For example I have this for /core directory:

Is that enough? Should I add something else?
And what about the other .htaccess files (the one that is in the site's root directory, for instance)?

The most secure way to handle the core is to move it outside of the web root.
https://rtfm.modx.com/revolution/2.x/administering-your-site/security/hardening-modx-revolution

If you aren't wanting to move the core outside of the webroot (recommended), the next best option would be doing this:

Just like this?

The most secure way to handle the core is to move it outside of the web root.

Agree. But how will I upgrade the engine after this? Won't it bring me additional headaches (if an upgrade script doesn't find the "core" where it should be)? I'm always a bit worried about customizing such things - you never know what it may turn to.

Btw,

What is the idea of allowing first and deniing then? Why not this?:

Quote from: takamaro at Dec 08, 2015, 04:03 PM

how will I upgrade the engine after this? Won't it bring me additional headaches (if an upgrade script doesn't find the "core" where it should be)?

During upgrade, when you run setup, the process will ask you for the path to the core if it can't find it in document root. Once you tell setup where it is, it proceeds onward from there.

Every Revo. installation I've ever done, I've put the core outside of document root. Upgrade has never been a problem.

Upgrade has never been a problem.

Well, if so, I'll do that for safety.

Quote from: takamaro at Dec 08, 2015, 04:10 PM

Btw,

Order Allow,Deny
Deny from All

What is the idea of allowing first and deniing then? Why not this?:

Order Deny, Allow
Deny from All

It just locks things down better. You can get content in some cases with the reverse order.

Quote from: takamaro at Dec 08, 2015, 04:03 PM

The most secure way to handle the core is to move it outside of the web root.

Agree. But how will I upgrade the engine after this? Won't it bring me additional headaches (if an upgrade script doesn't find the "core" where it should be)? I'm always a bit worried about customizing such things - you never know what it may turn to.

The UpgradeMODX extra reads the config.inc.php file and copies all the files to the correct locations regardless of where you put them. Setup will still ask you where the core is (I don't know why -- it should also be able to read the config file), but that's the only inconvenience.