########################################################################
# WORDPRESS .HTACCESS — HARDENED (wp2shell / CVE-2026-63030 protected)
# Everything above the BEGIN/END WordPress markers is safe — WP never
# overwrites anything outside them.
########################################################################

# ------------------------------------------------------------------
# 0. No directory listing
#    (If you get HTTP 500 right after pasting, delete this one line —
#     your host doesn't allow the Options override.)
# ------------------------------------------------------------------
Options -Indexes

# ------------------------------------------------------------------
# 1. WP2SHELL BLOCK — must come FIRST, before WP routes anything
#    to index.php. Covers BOTH URL forms, plain + URL-encoded.
# ------------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Form 1: /wp-json/batch/v1  (also covers /wp-json/batch/v1/batch)
  RewriteCond %{REQUEST_URI} ^/?wp-json/batch/v1 [NC]
  RewriteRule .* - [F,L]

  # Form 2: /?rest_route=/batch/v1  (works even with permalinks OFF)
  RewriteCond %{QUERY_STRING} (^|&)rest_route=(/|%2f)batch(/|%2f)v1 [NC]
  RewriteRule .* - [F,L]

  # ----------------------------------------------------------------
  # 2. No script execution in writable dirs — uploaded webshells
  #    return 403 instead of running
  # ----------------------------------------------------------------
  RewriteCond %{REQUEST_URI} ^/?wp-content/(uploads|upgrade|cache)/.*\.(php[0-9]?|phtml|phar|phps|cgi|pl|py|sh)$ [NC]
  RewriteRule .* - [F,L]

  # ----------------------------------------------------------------
  # 3. Block ?author=N admin-username enumeration (attack recon)
  # ----------------------------------------------------------------
  RewriteCond %{QUERY_STRING} (^|&)author=[0-9]+ [NC]
  RewriteRule .* - [F,L]
</IfModule>

# ------------------------------------------------------------------
# 4. wp-config.php — never readable over the web
# ------------------------------------------------------------------
<Files wp-config.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>

# ------------------------------------------------------------------
# 5. All dotfiles (.htaccess itself, .env, .git internals) — denied
# ------------------------------------------------------------------
<FilesMatch "^\.">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>
RedirectMatch 404 /\.git(/.*)?$

# ------------------------------------------------------------------
# 6. xmlrpc.php — legacy brute-force/pingback amplifier.
#    Delete ONLY this block if you use Jetpack or the WP mobile app.
# ------------------------------------------------------------------
<Files xmlrpc.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>

# ------------------------------------------------------------------
# 7. Default WordPress rules — untouched, between the markers
# ------------------------------------------------------------------
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress