


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# ============================
# SEGURIDAD ADICIONAL PARA WORDPRESS
# ============================

# Deshabilitar la ejecución de PHP en directorios de carga (uploads)
<Directory "/wp-content/uploads">
    php_flag engine off
</Directory>

# Proteger el archivo wp-config.php
<Files wp-config.php>
    Order Deny,Allow
    Deny from all
</Files>

# Proteger el archivo .htaccess
<Files .htaccess>
    Order Deny,Allow
    Deny from all
</Files>

# Evitar el acceso a wp-login.php y wp-admin por IPs no deseadas (ejemplo)
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 123.456.789.0
</Files>

# Prohibir el acceso a archivos sensibles (wp-config.php, .env, php.ini)
<FilesMatch "(wp-config.php|.env|php.ini)">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# ============================
# Proteger contra ataques XSS y Clickjacking
# ============================
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "DENY"

# ============================
# Habilitar HSTS (si tienes SSL)
# ============================
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php81” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
