# ====================================================================
# CUSTOM SECURITY RULES (Place at the top to ensure they run first)
# ====================================================================
# 1. Block WordPress xmlrpc.php requests (Stops Bot Remote Posting)
Order Deny,Allow
Deny from all
# 2. Protect wp-config.php (Hides your database credentials)
Order Deny,Allow
Deny from all
# 3. Protect .htaccess itself from being viewed or modified
Order Deny,Allow
Deny from all
# 4. Disable Directory Browsing (Stops bots from scanning your folders)
Options -Indexes
ServerSignature Off
# 5. Block PHP execution in wp-includes folder
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
# 6. Block Bot Author Scans (Stops username harvesting /?author=1)
RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} ^author=([0-9]+) [NC]
RewriteRule .* - [F,L]
# 7. Block access to developer/system files & backups
Order Deny,Allow
Deny from all
# 8. Block Hidden Files (e.g. .git, .user.ini, etc.)
RewriteEngine On
RewriteRule (^|/)\. - [F]
# 9. Block Basic SQL Injection and XSS Exploit Attempts
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ - [F,L]
# 10. Implement Essential Security Headers
# Prevent Clickjacking (Clickjacking Protection)
Header set X-Frame-Options "SAMEORIGIN"
# Prevent MIME Sniffing attacks
Header set X-Content-Type-Options "nosniff"
# Enable XSS Filter on older browsers
Header set X-XSS-Protection "1; mode=block"
# Control how referrer data is shared
Header set Referrer-Policy "strict-origin-when-cross-origin"
# Enforce SSL Connection (HSTS - 1 Year)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
# ====================================================================
# SYSTEM GENERATED BLOCKS (Do not modify inside these markers)
# ====================================================================
# BEGIN LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
RewriteEngine on
RewriteRule litespeed/debug/.*\.log$ - [F,L]
RewriteRule \.litespeed_conf\.dat - [F,L]
CacheLookup on
RewriteRule .* - [E=Cache-Control:no-autoflush]
### marker ASYNC start ###
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=async_litespeed
RewriteRule .* - [E=noabort:1]
### marker ASYNC end ###
### marker WEBP start ###
RewriteCond %{HTTP_ACCEPT} image/webp [OR]
RewriteCond %{HTTP_USER_AGENT} iPhone\ OS\ (1[4-9]|[2-9][0-9]) [OR]
RewriteCond %{HTTP_USER_AGENT} Macintosh.*Version/((1[7-9]|[2-9][0-9])|16\.([4-9]|[1-9][0-9])) [OR]
RewriteCond %{HTTP_USER_AGENT} Firefox/([6-9][0-9]|[1-9][0-9]{2,})
RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+webp]
### marker WEBP end ###
### marker DROPQS start ###
CacheKeyModify -qs:fbclid
CacheKeyModify -qs:gclid
CacheKeyModify -qs:utm*
CacheKeyModify -qs:_ga
### marker DROPQS end ###
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END LSCACHE
# BEGIN NON_LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END NON_LSCACHE
# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress