# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /

# 1. Proteger wp-login.php requiriendo la llave secreta
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [NC]
RewriteCond %{QUERY_STRING} !^llave=acceso-wp$
RewriteRule .* - [F,L]

# 2. Bloquear intentos de spam en comentarios (xmlrpc y wp-comments-post)
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} /wp-comments-post\.php$ [NC]
RewriteCond %{HTTP_REFERER} !^https://liceoausubel\.edu\.mx [NC]
RewriteRule .* - [F,L]

RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# 3. Prevenir la ejecución de scripts PHP en la carpeta uploads
<DirectoryMatch "/wp-content/uploads/">
  <FilesMatch "\.(php|php5|phtml|exe|pl|py|jsp|asp|htm|html|shtml)$">
      Order Deny,Allow
      Deny from all
  </FilesMatch>
</DirectoryMatch>

# 4. Proteger archivos de configuración y del sistema
<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

<Files .htaccess>
    Order Allow,Deny
    Deny from all
</Files>

# 5. Desactivar el listado de directorios
Options -Indexes<br />
<b>Fatal error</b>:  Uncaught Error: Call to undefined function wp() in /var/www/vhosts/liceoausubel.edu.mx/httpdocs/wp-blog-header.php:16
Stack trace:
#0 /var/www/vhosts/liceoausubel.edu.mx/httpdocs/index.php(17): require()
#1 {main}
  thrown in <b>/var/www/vhosts/liceoausubel.edu.mx/httpdocs/wp-blog-header.php</b> on line <b>16</b><br />