WordPress .htaccess security rules

gistfile1.txt

### Start Security Rules
# Stop spam attack logins and comments
<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} POST
        RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php*
        RewriteCond %{HTTP_REFERER} !.*(example.ubc.ca|.ubc.ca).* [OR]
        RewriteCond %{HTTP_USER_AGENT} ^$
        RewriteRule (.*) http://0.0.0.0/$ [R=301,L]
</ifModule>

# Block Registration Spam Attempts 
<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} GET
        RewriteCond %{HTTP_REFERER} !.*(.ubc.ca).* [OR]
        RewriteCond %{HTTP_USER_AGENT} ^$
        RewriteCond   %{REQUEST_URI}    ^/wp-login.php$
        RewriteCond   %{QUERY_STRING}   ^action=register$
        RewriteRule   (.*)  . [R=301,F]
</ifModule>

## Deny access to 
<files .htaccess>
Order allow,deny
Deny from all
</files>
<files readme.html>
Order allow,deny
Deny from all
</files>
<files readme.txt>
Order allow,deny
Deny from all
</files>

<files install.php>
Order allow,deny
Deny from all
</files>

<files wp-config.php>
Order allow,deny
Deny from all
</files>

# disbale access to xmlrpc
<Files "xmlrpc.php">
Order Allow,Deny
deny from all
</Files>

# No php execution in Multisite blogs.dir
RewriteRule ^(.*)/blogs.dir/(.*).php(.?) – [F]

# No php execution in uploads dur 
RewriteRule ^(.*)/uploads/(.*).php(.?) – [F]

#Block Sketchy User Agents
<IfModule mod_setenvif.c>
  SetEnvIfNoCase User-Agent ^$ keep_out
  SetEnvIfNoCase User-Agent (wget|sqlmap|python|libwww-perl) keep_out
  SetEnvIfNoCase User-Agent (nikto|scan) keep_out
  SetEnvIfNoCase User-Agent (pycurl|casper|cmsworldmap|diavol|dotbot) keep_out
  SetEnvIfNoCase User-Agent (flicky|jakarta|kmccrew) keep_out
  SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|planetwork) keep_out
  <Limit GET POST PUT>
    Order Allow,Deny
    Allow from all
    Deny from env=keep_out
  </Limit>
</IfModule>


# No php execution in Multisite blogs.dir
RewriteRule ^(.*)/blogs.dir/(.*).php(.?) – [F]

# No php execution in uploads dur 
RewriteRule ^(.*)/uploads/(.*).php(.?) – [F]

#Block Sketchy User Agents
<IfModule mod_setenvif.c>
  SetEnvIfNoCase User-Agent ^$ keep_out
  SetEnvIfNoCase User-Agent (wget|sqlmap|python|libwww-perl) keep_out
  SetEnvIfNoCase User-Agent (nikto|scan) keep_out
  SetEnvIfNoCase User-Agent (pycurl|casper|cmsworldmap|diavol|dotbot) keep_out
  SetEnvIfNoCase User-Agent (flicky|jakarta|kmccrew) keep_out
  SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|planetwork) keep_out
  <Limit GET POST PUT>
    Order Allow,Deny
    Allow from all
    Deny from env=keep_out
  </Limit>
</IfModule>

#Query String blocks
# Local file inclusion blocks
RewriteCond %{QUERY_STRING} (\.{1,}/)+(motd|etc|bin) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]

# XSS and SQL Blocks
# this section is dangerous can break some wordpress features/plugins
RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^e]*e)+mbed.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*object.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^o]*o)+bject.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|config|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ - [F,L]

# HTTP Trace attack block
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

########################
### End Security Rules #
########################