# Force HTTPS — plaintext logins were the original breach vector.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Block direct access to sensitive files.
<FilesMatch "^(wp-config\.php|readme\.html|license\.txt|xmlrpc\.php|aios-bootstrap\.php)$">
  Require all denied
</FilesMatch>

# No directory listings.
Options -Indexes

# Block TRACE / TRACK (cross-site tracing).
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F,L]
</IfModule>

# No PHP execution anywhere under uploads.
# (uploads/.htaccess also enforces this; belt and braces)

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress