# ----------------------------------------------------------------------
# Basic security & hygiene
# ----------------------------------------------------------------------
# Disable directory listings
Options -Indexes

# Prevent access to hidden files (.git, .env, etc.)
<FilesMatch "^\.">
  Require all denied
  # Apache 2.2 fallback:
  # Order allow,deny
  # Deny from all
</FilesMatch>

# Block sensitive WP files
<FilesMatch "(^readme\.html$|^license\.txt$|^wp-config\.php$|^php\.ini$|^error_log$)">
  Require all denied
  # Apache 2.2 fallback:
  # Order allow,deny
  # Deny from all
</FilesMatch>

# Limit HTTP methods to the usual suspects
<LimitExcept GET POST HEAD>
  Require all denied
  # Apache 2.2 fallback:
  # Order allow,deny
  # Deny from all
</LimitExcept>

# (Optional) Disable XML-RPC if you don't use Jetpack/app publishing
#<Files "xmlrpc.php">
#  Require all denied
#</Files>

# ----------------------------------------------------------------------
# WordPress core permalinks (do not edit between WP markers)
# ----------------------------------------------------------------------
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# If the requested file or directory exists, serve it.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Otherwise, route to index.php
RewriteRule . /index.php [L]
</IfModule>
# END WordPress