VirtualDocumentRoot with ReWrite to prevent access to directories - wordpress

Question

I've got a VirtualDocumentRoot working perfectly, but I'd like to prevent access to a specific folder inside each document root through the VirtualHost directive so I don't need an .htaccess file in each document root, but I can't seem to get the blocking to work. (The virtual host works perfectly, but I can access wp-includes directly through the browser and I shouldn't be able to).
Here's what I have:
<VirtualHost 127.0.0.1:80>
UseCanonicalName Off
ServerName default
ServerAlias *
RewriteEngine On
RewriteCond %{HTTP_HOST} ^(www\.)?(.*)$
RewriteRule ^/(.*)$ "/Users/me/My Sites/%2/wordpress/$1"
VirtualDocumentRoot "/Users/me/My Sites/%0/wordpress"
<Directory "/Users/me/My Sites/*/wordpress">
RewriteEngine On
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
Options -Indexes +FollowSymLinks +Includes
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Browsing to domain.com/wp-includes should serve up a forbidden page, but I created the directory and put an index.php in there, and I can browse right to it and see the output.
If I put the Rewrite (from the Directory) into an .htaccess file in the wordpress directory, it works fine. But once I put it into Directory...bupkis.
Any ideas where I'm going wrong?

Answer 1

In .htaccess, the ^ part of the RewriteRule says, "process this from the RewriteBase" on a per-directory bases but it doesn't work in a Directory rule. So your current rules would process relative to the / directory on your server.
For your purposes in WordPress, remove the caret before each one. This will process the RewriteRules for any directory/file matching the rule which shouldn't be a problem because WordPress core should be the only one creating and using wp-admin and wp-includes as directories and you always want those blocked.