enter your ftp www fodler and change permissions of
.user.ini
.htaccess
from 644 to 640
basically remove read from public permissions.
rescan with Wordfence Scan … fixed.
you can check with
http://www.website.com/.user.ini
http://www.website.com/.htaccess
they should both give you error 404.
