# --- HARDEN EXPLOIT & ENUMERATION ---
<IfModule mod_rewrite.c>
RewriteEngine On
# Blokir XMLRPC mati total
RewriteRule ^xmlrpc\.php$ - [F,L]
# Blokir Author Scan (?author=N)
RewriteCond %{QUERY_STRING} ^author=([0-9]+) [NC]
RewriteRule .* - [F,L]
# Blokir Feed RSS jika bukan browser biasa
RewriteCond %{REQUEST_URI} ^/(feed|rss2?)/? [NC]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|curl|wget) [NC]
RewriteRule .* - [F,L]
</IfModule>

# BEGIN LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule litespeed/debug/.*\.log$ - [F,L]
RewriteRule \.litespeed_conf\.dat - [F,L]
</IfModule>
<IfModule LiteSpeed>
CacheLookup on
RewriteRule .* - [E=Cache-Control:no-autoflush]

### marker ASYNC start ###
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=async_litespeed
RewriteRule .* - [E=noabort:1]
### marker ASYNC end ###

### marker DROPQS start ###
CacheKeyModify -qs:fbclid
CacheKeyModify -qs:gclid
CacheKeyModify -qs:utm*
CacheKeyModify -qs:_ga
### marker DROPQS end ###

</IfModule>
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END LSCACHE
# BEGIN NON_LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
### marker BROWSER CACHE start ###
<IfModule mod_expires.c>
ExpiresActive on
ExpiresByType application/pdf A31557600
ExpiresByType image/x-icon A31557600
ExpiresByType image/vnd.microsoft.icon A31557600
ExpiresByType image/svg+xml A31557600

ExpiresByType image/jpg A31557600
ExpiresByType image/jpeg A31557600
ExpiresByType image/png A31557600
ExpiresByType image/gif A31557600
ExpiresByType image/webp A31557600
ExpiresByType image/avif A31557600

ExpiresByType video/ogg A31557600
ExpiresByType audio/ogg A31557600
ExpiresByType video/mp4 A31557600
ExpiresByType video/webm A31557600

ExpiresByType text/css A31557600
ExpiresByType text/javascript A31557600
ExpiresByType application/javascript A31557600
ExpiresByType application/x-javascript A31557600

ExpiresByType application/x-font-ttf A31557600
ExpiresByType application/x-font-woff A31557600
ExpiresByType application/font-woff A31557600
ExpiresByType application/font-woff2 A31557600
ExpiresByType application/vnd.ms-fontobject A31557600
ExpiresByType font/ttf A31557600
ExpiresByType font/otf A31557600
ExpiresByType font/woff A31557600
ExpiresByType font/woff2 A31557600

</IfModule>
### marker BROWSER CACHE end ###

## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END NON_LSCACHE

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
# BEGIN WPvivid_Restore
# The directives (lines) between "BEGIN WPvivid_Restore" and "END WPvivid_Restore" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.

# END WPvivid_Restore
<Files 403.shtml>
order allow,deny
allow from all
</Files>

deny from 72.167.50.103

deny from 91.92.243.240
deny from 144.91.88.114
deny from 20.243.185.37
deny from 103.59.160.213
deny from 4.230.16.89
deny from 13.233.225.212
deny from 198.38.94.18

deny from 34.73.211.186
deny from 188.166.225.40
deny from 119.82.255.234

# BLOCK XMLRPC & EXPLOITS
<Files xmlrpc.php>
order allow,deny
deny from all
</Files>

<Files wp-cron.php>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
</Files>
deny from 180.94.8.69
deny from 23.248.170.199
deny from 2.27.116.8
deny from 103.87.68.153
deny from 182.9.195.121
deny from 114.10.101.47
deny from 130.12.180.111


# --- HARDENING BOT ATTACKS ---
<Files "xmlrpc.php">
  Require all denied
</Files>
<Files "install.php">
  Require all denied
</Files>



# --- ADVANCED BOT & BRUTE FORCE PROTECTION ---
<Files "xmlrpc.php">
  Require all denied
</Files>
<Files "install.php">
  Require all denied
</Files>

# Blokir file scanner malware & backdoor umum
<FilesMatch "(mek\.php|bug\.php|shell\.php|alfa\.php|wp-links-opml\.php)">
  Require all denied
</FilesMatch>

# Batasi POST wp-login hanya jika ada referer valid dari domain sendiri
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} POST
  RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php*
  RewriteCond %{HTTP_REFERER} !.*%{HTTP_HOST}.* [NC]
  RewriteRule ^(.*)$ - [F,L]
</IfModule>



# --- HARDEN WP-LOGIN AGAINST BRUTE FORCE ---
<Files "wp-login.php">
  <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?[a-zA-Z0-9.-]+\.[a-zA-Z]{2,} [NC]
    RewriteRule .* - [F,L]
  </IfModule>
</Files>



# --- BLOCK BLANK & GENERIC FAKE USER AGENTS ---
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP_USER_AGENT} ^Mozilla/5\.0$ [NC,OR]
  RewriteCond %{HTTP_USER_AGENT} ^$
  RewriteRule ^(wp-login|xmlrpc)\.php - [F,L]
</IfModule>