# BEGIN WordPress
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# Disable directory browsing
Options -Indexes

# Block SQL injection attempts
#<IfModule mod_rewrite.c>
#    RewriteEngine On
#    RewriteCond %{QUERY_STRING} (\<|\>|\*|\'|\"|union|select|insert|update|drop|--|;|#) [NC]
#    RewriteRule ^(.*)$ - [F,L]
#</IfModule>

# Prevent Clickjacking
Header always append X-Frame-Options SAMEORIGIN

# SQL Injection Prevention (Basic)
#<Files ~ "\.(zip|exe|tar|rar|.sql)$">
#    Order Deny,Allow
#    Deny from all
#</Files>

# Disable access to wp-login.php except for specified IPs
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 115.114.77.95
    Allow from 223.178.83.75
    Allow from 223.178.82.224
    Allow from 124.123.71.165
    Allow from 122.164.13.200
    Allow from 106.201.177.120
    Allow from 203.101.43.27
    Allow from 223.178.83.246
    Allow from 223.178.85.234
#    Allow from 154.61.173.91
    Allow from 13.233.169.11
    Allow from 60.243.13.119
</Files>

# Prevent Host Header Injection
SetEnvIf Host ^(www\.)?indianconcreteinstitute\.org$ valid_host
Order Deny,Allow
Deny from all
Allow from env=valid_host

# Deny access to sensitive files
<Files readme.html>
    Require all denied
</Files>
<Files ~ "\.exe$">
    Require all denied
</Files>

# Block access to .htaccess and .htpasswd files
<Files ~ "^\.ht">
    Require all denied
</Files>

# End of .htaccess file