Problem is directory’s such as /wp-includes/ are viewable.
Disable directory traversal by adding this line to the end of your .htaccess file in the root of your website directory:
Options All -Indexes
Then restart:
systemctl restart apache2
Confirm this is disabled by navigating to /wp-includes/