Regarding your solution for hiding domain.com/wp-admin/admin-ajax.php by adding a rewrite rule to .htaccess… wouldn’t this block access to admin-ajax.php from the backend as well, thereby breaking many plugin admin functions?
Should it look like this?
RewriteRule ^custom /wp-admin/admin-ajax.php [QSA,L]
RewriteRule ^/wp-admin/admin-ajax\.php /nothing_404_404 [QSA,L]