I still wouldn't want to deploy WordPress on Caddy until it's more
obvious and standard to block paths that shouldn't be accessible.
It seems that this is still left as an exercise to the site admin.
This discussion has some tips, but it is four years old and hasn't
changed since I last looked.
See: https://caddy.community/t/using-caddy-to-harden-wordpress/13575
