N WordPress RewriteEngine On RewriteBase /wp/

Redirect HTTP to HTTPS¶

RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Redirect old blog path to new¶

RewriteRule ^blog/(.*)$ /wp/news/$1 [R=301,L]

Redirect specific page¶

RewriteRule ^old-about/?$ /wp/about-us/ [R=301,L]

Block xmlrpc.php¶

RewriteRule ^xmlrpc.php$ - [F,L]

WordPress core rewrites¶

RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /wp/index.php [L]

END WordPress¶

Block bad bots¶

RewriteEngine On RewriteCond %{HTTP_USER_AGENT} ClaudeBot/1.0 [NC,OR] RewriteCond %{HTTP_USER_AGENT} SemrushBot [NC,OR] RewriteCond %{HTTP_USER_AGENT} AhrefsBot [NC] RewriteRule ^.* - [F,L]

Security headers¶

Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin"

Protect wp-config¶

Order allow,deny Deny from all

Disable directory browsing¶

Options -Indexes

PHP file upload limit override¶

php_value upload_max_filesize 64M php_value post_max_size 64M php_value max_execution_time 300

Cache static assets¶

ExpiresActive On ExpiresByType image/jpeg "access plus 1 year" ExpiresByType image/png "access plus 1 year" ExpiresByType text/css "access plus 1 month" ExpiresByType application/javascript "access plus 1 month"