Ordner von WordPress ausschließen

# Rules to block access to WordPress specific files
<files .htaccess>
	Order allow,deny
	Deny from all
</files>
<files readme.html>
	Order allow,deny
	Deny from all
</files>
<files readme.txt>
	Order allow,deny
	Deny from all
</files>
<files install.php>
	Order allow,deny
	Deny from all
</files>
<files wp-config.php>
	Order allow,deny
	Deny from all
</files>
		
# Rules to disable XML-RPC
<files xmlrpc.php>
	Order allow,deny
	Deny from all
</files>
		
# Rules to disable directory browsing
Options -Indexes
<IfModule mod_rewrite.c>
	RewriteEngine On
		
	# Rules to protect wp-includes
	RewriteRule ^wp-admin/includes/ - [F]
	RewriteRule !^wp-includes/ - [S=3]
	RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
	RewriteRule ^wp-includes/[^/]+\.php$ - [F]
	RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F]
	RewriteRule ^wp-includes/theme-compat/ - [F]


	# Rules to prevent php execution in uploads
	RewriteRule ^(.*)/uploads/(.*).php(.?) - [F]


	# Rules to block unneeded HTTP methods
	RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]
	RewriteRule ^(.*)$ - [F]


	# Rules to block suspicious URIs
	RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*\.(bash|git|hg|log|svn|swp|cvs) [NC,OR]
	RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
	RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
	RewriteCond %{QUERY_STRING} ftp\:  [NC,OR]
	RewriteCond %{QUERY_STRING} http\:  [NC,OR]
	RewriteCond %{QUERY_STRING} https\:  [NC,OR]
	RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
        RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
	RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
	RewriteCond %{QUERY_STRING} ^.*(request|concat|insert|union|declare).* [NC]
	RewriteCond %{QUERY_STRING} !^loggedout=true
	RewriteCond %{QUERY_STRING} !^action=jetpack-sso
	RewriteCond %{QUERY_STRING} !^action=rp
	RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
	RewriteCond %{HTTP_REFERER} !^http://maps\.googleapis\.com(.*)$
	RewriteRule ^(.*)$ - [F]


	# Rules to block foreign characters in URLs
	RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F).* [NC]
	RewriteRule ^(.*)$ - [F]
		
	# Rules to help reduce spam
	RewriteCond %{REQUEST_METHOD} POST
	RewriteCond %{REQUEST_URI} ^(.*)wp-comments-post\.php*
	RewriteCond %{HTTP_REFERER} !^.* 
	RewriteCond %{HTTP_REFERER} !^http://jetpack\.wordpress\.com/jetpack-comment/ [OR]
	RewriteCond %{HTTP_USER_AGENT} ^$
	RewriteRule ^(.*)$ - [F]
</IfModule>


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress


# ETags abschalten
Header unset ETag
FileETag None


# GZIP aktivieren
mod_gzip_on Yes


# CACHING #
<IfModule mod_expires.c>
ExpiresActive On 
ExpiresByType text/css "access plus 1 week" 
ExpiresByType text/javascript "access plus 1 month" 
ExpiresByType text/html "access plus 300 seconds" 
ExpiresByType application/javascript "access plus 1 month" 
ExpiresByType application/x-javascript "access plus 1 month" 
ExpiresByType application/xhtml-xml "access plus 300 seconds" 
ExpiresByType image/gif "access plus 1 month" 
ExpiresByType image/jpeg "access plus 1 week" 
ExpiresByType image/jpg "access plus 1 week" 
ExpiresByType image/png "access plus 1 week" 
ExpiresByType image/x-icon "access plus 1 month"
ExpiresDefault "access 1 day"
</IfModule>