readme.html is public
Effort to fix: Quick win (under an hour)
Why it matters
The default readme advertises that this is WordPress and can reveal version details.
How to fix it
Delete /readme.html (it's recreated on core updates, so block it at the server instead).
On WordPress
Block it in .htaccess (<Files readme.html> Require all denied </Files>) or the Nginx config so updates don't bring it back.