JezK
Edit File: .htaccess
# ================================================== # WordPress Default Rules # ================================================== <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> # ================================================== # MIME TYPE FIX (SVG SUPPORT) # ================================================== AddType image/svg+xml .svg AddType image/svg+xml .svgz # ================================================== # BASIC SECURITY # ================================================== # Disable directory browsing Options -Indexes # Protect wp-config.php <Files wp-config.php> Require all denied </Files> # Protect .htaccess <Files .htaccess> Require all denied </Files> # Block readme & license files <FilesMatch "^(readme\.html|license\.txt|wp-config-sample\.php|debug\.log|error_log)$"> Require all denied </FilesMatch> # ================================================== # BLOCK PHP EXECUTION IN UPLOADS ONLY (SAFE WAY) # ================================================== <IfModule mod_rewrite.c> RewriteRule ^wp-content/uploads/.*\.(php[0-9]?|phtml)$ - [F,L] </IfModule> # ================================================== # PROTECT WP-INCLUDES # ================================================== <IfModule mod_rewrite.c> RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+\.php$ - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L] </IfModule> # ================================================== # BLOCK XMLRPC (if not using Jetpack) # ================================================== <Files xmlrpc.php> Require all denied </Files> # ================================================== # BLOCK AUTHOR ENUMERATION # ================================================== <IfModule mod_rewrite.c> RewriteCond %{QUERY_STRING} ^author=\d+ [NC] RewriteRule .* - [F,L] </IfModule> # ================================================== # BLOCK SUSPICIOUS QUERY STRINGS # ================================================== <IfModule mod_rewrite.c> RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR] RewriteCond %{QUERY_STRING} (\.\./) [NC,OR] RewriteCond %{QUERY_STRING} (etc/passwd|boot\.ini) [NC,OR] RewriteCond %{QUERY_STRING} (eval\() [NC] RewriteRule .* - [F,L] </IfModule> # ================================================== # DISABLE TRACE/TRACK # ================================================== <IfModule mod_rewrite.c> RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F,L] </IfModule> # ================================================== # REMOVE SERVER SIGNATURE # ================================================== ServerSignature Off # Remove X-Powered-By <IfModule mod_headers.c> Header always unset X-Powered-By Header set Referrer-Policy "strict-origin-when-cross-origin" Header set X-Content-Type-Options "nosniff" Header set X-Frame-Options "SAMEORIGIN" Header set Permissions-Policy "geolocation=(), microphone=(), camera=()" </IfModule>