# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
<Files wp-config.php>
<IfModule !mod_authz_core.c>
order allow,deny
deny from all
</IfModule>
<IfModule mod_authz_core.c>
require all denied
</IfModule>
</Files>

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
AddHandler application/x-httpd-ea-php82 .php .php8 .phtml


# =============================================
# WooCommerce + WordPress CPU Optimization
# =============================================

<IfModule mod_rewrite.c>
RewriteEngine On

# Block XML-RPC to prevent brute force / bot hits
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

# Block common bad bots
RewriteCond %{HTTP_USER_AGENT} ^.*(bot|crawler|spider|checker|wget|curl|python|scrapy).*$ [NC]
RewriteRule .* - [F,L]

# Optional: Block empty user agents
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F,L]

</IfModule>

# ---------------------------------------------
# Optional: Limit WooCommerce AJAX calls (Apache)
# ---------------------------------------------
<IfModule mod_ratelimit.c>
# Limit wc-ajax.php to 2 requests per second per IP
<FilesMatch "wc-ajax.php">
    SetEnv rate-limit 2
</FilesMatch>
</IfModule>

# ---------------------------------------------
# Security headers (optional, small CPU impact)
# ---------------------------------------------
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
</IfModule>

RewriteEngine On

# Force HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Force non-www (optional - choose one style)
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
