# ====================================================================
# CUSTOM SECURITY RULES (Place at the top to ensure they run first)
# ====================================================================

# 1. Block WordPress xmlrpc.php requests (Stops Bot Remote Posting)
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

# 2. Protect wp-config.php (Hides your database credentials)
<Files wp-config.php>
    Order Deny,Allow
    Deny from all
</Files>

# 3. Protect .htaccess itself from being viewed or modified
<Files .htaccess>
    Order Deny,Allow
    Deny from all
</Files>

# 4. Disable Directory Browsing (Stops bots from scanning your folders)
Options -Indexes
ServerSignature Off

# 5. Block PHP execution in wp-includes folder
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# 6. Block Bot Author Scans (Stops username harvesting /?author=1)
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} ^author=([0-9]+) [NC]
RewriteRule .* - [F,L]
</IfModule>

# 7. Block access to developer/system files & backups
<FilesMatch "^(composer\.json|composer\.lock|package\.json|package-lock\.json|yarn\.lock|\.env|.*\.sql|.*\.bak|.*\.zip)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# 8. Block Hidden Files (e.g. .git, .user.ini, etc.)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule (^|/)\. - [F]
</IfModule>

# 9. Block Basic SQL Injection and XSS Exploit Attempts
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ - [F,L]
</IfModule>

# 10. Implement Essential Security Headers
<IfModule mod_headers.c>
    # Prevent Clickjacking (Clickjacking Protection)
    Header set X-Frame-Options "SAMEORIGIN"
    
    # Prevent MIME Sniffing attacks
    Header set X-Content-Type-Options "nosniff"
    
    # Enable XSS Filter on older browsers
    Header set X-XSS-Protection "1; mode=block"
    
    # Control how referrer data is shared
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    
    # Enforce SSL Connection (HSTS - 1 Year)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ====================================================================
# SYSTEM GENERATED BLOCKS (Do not modify inside these markers)
# ====================================================================

# BEGIN LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule litespeed/debug/.*\.log$ - [F,L]
RewriteRule \.litespeed_conf\.dat - [F,L]
</IfModule>
<IfModule LiteSpeed>
CacheLookup on
RewriteRule .* - [E=Cache-Control:no-autoflush]

### marker ASYNC start ###
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=async_litespeed
RewriteRule .* - [E=noabort:1]
### marker ASYNC end ###

### marker WEBP start ###
RewriteCond %{HTTP_ACCEPT} image/webp [OR]
RewriteCond %{HTTP_USER_AGENT} iPhone\ OS\ (1[4-9]|[2-9][0-9]) [OR]
RewriteCond %{HTTP_USER_AGENT} Macintosh.*Version/((1[7-9]|[2-9][0-9])|16\.([4-9]|[1-9][0-9])) [OR]
RewriteCond %{HTTP_USER_AGENT} Firefox/([6-9][0-9]|[1-9][0-9]{2,})
RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+webp]
### marker WEBP end ###

### marker DROPQS start ###
CacheKeyModify -qs:fbclid
CacheKeyModify -qs:gclid
CacheKeyModify -qs:utm*
CacheKeyModify -qs:_ga
### marker DROPQS end ###

</IfModule>
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END LSCACHE

# BEGIN NON_LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END NON_LSCACHE

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress