# Scanner / exploit blocking
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-config\.php$ - [F,L]
RewriteCond %{REQUEST_URI} ^/(login|app|officialsite|Alvin9999|theme/|static/icon|assets/index/kuailian|assets/fire_admin|assets/images/icon-vpnweb|assets/images/logo-cn-vpnweb|details/images)/ [NC]
RewriteRule ^ - [F,L]
RewriteCond %{REQUEST_URI} (^|/)(alfacgiapi|ALFA_DATA)(/|$) [NC,OR]
RewriteCond %{REQUEST_URI} (seotheme/db\.php|plugins/fix/up\.php|plugins/apikey/apikey) [NC,OR]
RewriteCond %{REQUEST_URI} ^/(\.env|\.git|\.svn|web\.config) [NC,OR]
RewriteCond %{REQUEST_URI} ^/home/ [NC]
RewriteRule ^ - [F,L]
RewriteCond %{REQUEST_URI} ^/[^/]+\.php(\?.*)?$ [NC]
RewriteCond %{REQUEST_URI} !^/(index|wp-activate|wp-blog-header|wp-comments-post|wp-config-sample|wp-cron|wp-links-opml|wp-load|wp-login|wp-mail|wp-settings|wp-signup|wp-trackback|xmlrpc)\.php [NC]
RewriteRule ^ - [F,L]
RewriteRule ^xmlrpc\.php$ - [F,L]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} (nikto|sqlmap|wpscan|acunetix|nessus|dirbuster|gobuster|ffuf|masscan|zgrab|nuclei) [NC]
RewriteRule ^ - [F,L]
</IfModule>

# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress