maybe.txt

*## Some .htacces if needed, add them with notepad++ on your .htaccess1 or your own htaccess:)*##
.....................................................................:)
# Bots Using Fake User-Agents  : use wirh care! can block legitime visitors!

* If you want to use, place between:

<IfModule mod_rewrite.c>
RewriteRule ^.* - [F,L]
</IfModule>
........................................................................
# Hide folder: Not visible Folder, place in a .htaccess in folder where you want it.

IndexOptions -ShowForbidden

OR:
Options +FollowSymLinks -MultiViews -Indexes

........................................................................
# These HELL Spammers and Hackers:

RewriteCond %{HTTP_USER_AGENT} ^-?$ [OR]
RewriteCond %{HTTP_USER_AGENT} "^\(" [OR]
RewriteCond %{HTTP_USER_AGENT} ^\' [OR]
RewriteCond %{HTTP_USER_AGENT} "^\ " [OR]
RewriteCond %{HTTP_USER_AGENT} ^\" [OR]
RewriteCond %{HTTP_USER_AGENT} ^- [OR]
RewriteCond %{HTTP_USER_AGENT} ^= [OR]
RewriteCond %{HTTP_USER_AGENT} ^\.$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^\\$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^\d [OR]
RewriteCond %{HTTP_USER_AGENT} "^Chrome" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Empty" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Firefox" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^IE" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Internet\ Explorer" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^MSIE" [NC,OR]

# Non-standard endings:

RewriteCond %{HTTP_USER_AGENT} "Chrome$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox$" [NC,OR]

# Way too short user agent strings:

RewriteCond %{HTTP_USER_AGENT} "^Mozilla$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla\ compatible$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d\ \(compatible\)$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d\ \(compatible;\)$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Opera$" [NC,OR]

# Repeating same stuff:

RewriteCond %{HTTP_USER_AGENT} "compatible.*compatible" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko.*Gecko" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla.*Mozilla" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*MSIE" [NC,OR]

# Missing space after closing parenthesis:

RewriteCond %{HTTP_USER_AGENT}"\)([a-z|A-Z])" [NC,OR]

# Fake mixtures of browsers:

RewriteCond %{HTTP_USER_AGENT} "Firefox.*Netscape" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox.*Opera" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Chrome/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Firefox" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Edge/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*rv:" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera.*Trident/" [NC,OR]

# Letters instead of version numbers:

RewriteCond %{HTTP_USER_AGENT} "Chrome/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/([a-z]|[A-Z]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ ([a-z]|[A-Z])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\ rv:([a-z]|[A-Z])\." [NC,OR]

# Impossible Mozilla versions:

RewriteCond %{HTTP_USER_AGENT} "Mozilla/([0-3]|[6-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9]|6[0-9]|7[0-9]|8[0-9]|9[0-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.([1-9])" [NC,OR]

# Impossible MSIE versions:

RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\d\.([1-9])" [NC,OR]

# Impossible MSIE versions on certain Windows versions:

RewriteCond %{HTTP_USER_AGENT} "MSIE\ 5\..*\ NT\ 6\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 5\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 6\..*\ NT\ 6\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 6\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 6\.2" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 6\.2" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ NT\ 10" [NC,OR]

# Impossible MSIE and Trident combinations:

RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ Trident/([0-3]|[5-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ Trident/([0-4]|[6-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ Trident/([0-5]|[7-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*\ Trident/([0-6]|[8-9]);\ rv:11\.0" [NC,OR]

# Other impossible browser or engine version numbers:

RewriteCond %{HTTP_USER_AGENT} "Chrome/99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Chrome/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Opera/9\.99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Presto/9" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Trident/\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Trident/([0-3]|[8-9])" [NC,OR]

# Mismatching Firefox and rv versions:

RewriteCond %{HTTP_USER_AGENT} ".*rv:1\..*Firefox/(0|[2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:2\..*Firefox/([0-1]|[2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:3\..*Firefox/([0-2]|[4-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:4\..*Firefox/([0-3]|[5-9])" [NC,OR]

# Fake user agents used while testing programs and apps:

RewriteCond %{HTTP_USER_AGENT} "BUILDDATE" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^MyApp$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Synapse\)" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Test\ Certificate\ Info" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Unknown" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "WinHTTP" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "WinHttpRequest" [NC,OR]

# Other standards-breaking fake user agents:

RewriteCond %{HTTP_USER_AGENT} "\ \(Chrome\)" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\(Win/$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "compatible\ ;" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "CAIMEO\ Artificial\ Intelligence" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/\ " [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/20([2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "-IE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\ IE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla\ ([0-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.\d\(" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.\d\ \(\ " [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^QuickTime/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "SuperCleaner" [OR]
RewriteCond %{HTTP_USER_AGENT} "User\ Agent" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows/" [NC,OR]

# Fake Windows strings and versions:

RewriteCond %{HTTP_USER_AGENT} "Windows/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ ([0-2]|[4-8])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\)" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 0" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 1\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ ([2-3]|[7-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 5\.([3-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 6\.([4-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 10\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ (1[1-9]|4[0-9]|5[0-9]|6[0-9])" [NC,OR]

# Suspicious user agents:
RewriteCond %{HTTP_USER_AGENT} "TO-Browser/TOB" [NC]

# Redirect during the testing period:

 RewriteRule .* /strangebrowser.html? [R=307,L]
# Comment out the line above and remove the comment mark below to block fake browsers after the testing period:
RewriteRule ^.*$ - [F,L]

## Part 2 - additional bad browser rules with conditions:

RewriteCond %{REQUEST_URI} !strangebrowser\.html
RewriteCond %{REMOTE_ADDR} !^131\.253\.25\.
RewriteCond %{HTTP_USER_AGENT} "Trident/.*Trident" [NC]

# Redirect during the testing period:
RewriteRule .* /strangebrowser.html? [R=307,L]

# Comment out the line above and remove the comment mark below to block fake browsers after the testing period:
RewriteRule ^.*$ - [F,L]

# 2. Firefox full version numbers are used by WaterFox,
# Add your informative page to prevent redirection loops:

RewriteCond %{REQUEST_URI} !strangebrowser\.html
RewriteCond %{HTTP_USER_AGENT} !Waterfox/\d\d\.
RewriteCond %{HTTP_USER_AGENT} !Waterfox\)
RewriteCond %{HTTP_USER_AGENT} ".*Firefox/\d\d\.\d\."

# Redirect during the testing period:
# RewriteRule .* /strangebrowser.html? [R=307,L]

# Comment out the line above and remove the comment mark below to block fake browsers after the testing period:
RewriteRule ^.*$ - [F,L]

# 3. MSIE user string must also have a Trident version:
RewriteCond %{REQUEST_URI} !strangebrowser\.html

# Exclusions:
# VirusTotal Cloud uses MSIE 9.0; Windows NT 9.0 user agent

RewriteCond %{HTTP_USER_AGENT} !virustotalcloud\)$
## The rule:
RewriteCond %{HTTP_USER_AGENT} !Trident/
RewriteCond %{HTTP_USER_AGENT} MSIE\ .*Windows

# Comment out the line above and remove the comment mark below to block fake browsers after the testing period
RewriteRule ^.*$ - [F,L]

# 4. PaleMoon has higher Gecko version numbers than other browsers:

RewriteCond %{REQUEST_URI} !strangebrowser\.html
RewriteCond %{HTTP_USER_AGENT} !PaleMoon/
RewriteCond %{HTTP_USER_AGENT} "Gecko/201([1-9])"

# Redirect during the testing period:
RewriteCond %{REQUEST_URI} !strangebrowser\.html
RewriteCond %{REMOTE_ADDR} !^131\.253\.25\.

# Redirect during the testing period:
RewriteRule .* /strangebrowser.html? [R=307,L]
RewriteRule ^.*$ - [F,L]

...........................................................
# Bad bots:

RewriteCond %{HTTP_USER_AGENT} ^-?$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (&lt;|%0a|%0d|%27|%3c|%3e|%00|0x00) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ((c99|php|web)shell|remoteview|site((.){0,2})copier) [NC,OR]

# Bots spoofing old browsers or operating systems:
RewriteCond %{HTTP_USER_AGENT} ^.*(Chrome\/[1-7][0-9]).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(epiphany|Kazehakase).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Firefox\/[1-9]\.|Firefox\/[1-7][1-9]\.|Firefox\/40\.).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Mac\ OS\ X\ 10_[0-6]_[0-9]).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(MSIE\ [1-8]).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(PPC\ Mac).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(SeaMonkey).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Windows\ NT\ [3-5]\[0-9]|Windows\ NT\ 6\.0).*$ [NC,OR]

# User agents of other bad bots:
RewriteCond %{HTTP_USER_AGENT} ^.*(2345Explorer|360Spider|4147\.135|6899browser).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(acapbot|aiohttp|Adsbot|AHC\alexibot|AliApp|ALittle\ Client).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(AskTb|AspiegelBot|aylienbot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(attackbot|AwarioSmartBot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(backdorbot|BaiduClient|becomebot|BegunAdvertising|betabot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(BIDUBrowser|binlar|bitvore|blackwidow|blowfish).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(BoBrowser|BoogleBot|bsala|burpcollaborator).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Buck|bullseye|bunnys|butterfly|bytespider).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(centurybot|Campaign|clark-crawler|curl).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(datacha|DataForSeoBot|Datanyze|demon|devworx).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(diavol|Diffbot|Digincore|DingTalk|discobot|dittospyder).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(DomainAppender|DOWNLOADED|dotbot|dotnetdotcom|dumbot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Edition|evc-batch|evc-batch).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Framafox).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Go-http-client|GreenBrowser|Gregarius|GRequests).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Headless|Scan).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(icarus6j).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Java|Jersey|JuziBrowser).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(K-Ninja|Kinza|kmccrew).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(LanaiBot|LieBaoFast|Lightspeed|LMY47V|ltx71).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(MANAGED|Manzama|MauiBot|Mb2345Browser|MetaSr|MegaIndex).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(MicroMessenger|Moreover|MoodleBot|MQQBrowser).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(NameOfAgent|Namoroka|Netscape|newspaper).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(node\-fetch|Nuclei|null|Nutch).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(OcIdWebView|octopus|okhttp|OPPO|orgprobe|OWASMIME).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(PageFreezer|PaperLiBot|Pcore|PetalBot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(PostmanRuntime|PR-CY\.RU|pshtt|Pubmatic|python\-requests).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(QIHU\ 360SE|QQBrowser|queryn|queryseeker|QupZilla).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Re\-re|Readability|Riddler|robots|Ruby|ruby).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(SabsimBot|scpitspi).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Seekport|SeoBotM6|seocharger|SEOkicks|serpstatbot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Shuame|SlimBrowser|Sogou|SonyEricssonW660|spaziodati|splash).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(TencentTraveler|TheWorld|TkBot|ToBeFilledByOEM).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(UBrowser|UCBrowser|UNKNOWN|UserAgent\-Cube).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(vampire|VelenPublicWebCrawler|vikspider|voideye|vuhuvBot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(webleacher|webreaper|webstripper|webvac|webviewer|webwhacker).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(Wget|winhttp|wwwoffle|woxbot).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(x\.x\.x|xaldon|xenu|xxxyy).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(YaBrowser|YandexBot|yamanalab|yioopbot|YisouSpider|youda).*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(zeus|zgrab|zh\-CN|zh_CN|ZHCN|zmeu|zune|zyborg).*$ [NC]
RewriteRule ^(.*)$ - [R=403,L]

-------------------------------------------------------------------------------------------

RewriteCond %"{HTTP_USER_AGENT}" "gecko/20060728" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "ltx71" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "msie3" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "msie 3" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "msie5" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "msie 5.5" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "msie 6.0" [OR,NC]
RewriteCond %"{HTTP_USER_AGENT}" "mozilla/4.76" [OR,NC]

# OTHERS:
RewriteCond %{HTTP_USER_AGENT}!^.*Mozilla\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT}!^.*Chrome\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT}!^.*Firefox\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT}!^.*MSIE\s[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT}^.*Opera* [NC]
RewriteCond %{HTTP_USER_AGENT}^.*Mozilla* [NC]
Rewritecond %{HTTP_USER_AGENT}“.*MSIE 6.0; Windows NT 5.1; SV1.$”[NC]
Rewritecond %{HTTP_USER_AGENT}“.*MSIE 6.0; Windows NT 5.1;1813.$”[NC]

# AND:
RewriteCond %{HTTP_REFERER}^$
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteCond %{HTTP_USER_AGENT} ^User-Agent
RewriteCond %{HTTP_USER_AGENT} Java.*

----

# Alternative: Just add it above!
Here we assume certain MSIE 6.0 agents are from linkscanner #redirect these requests back to avg in the hope they’ll see their silliness!

Rewritecond %{HTTP_USER_AGENT}“.*MSIE 6.0; Windows NT 5.1; SV1.$”[OR]
Rewritecond %{HTTP_USER_AGENT}“.*MSIE 6.0; Windows NT 5.1;1813.$”
RewriteCond %{HTTP_REFERER}^$RewriteCond %{HTTP:Accept-Encoding}^$
RewriteRule ^.* http://www.avg.com/?LinkScannerSucks [R=307,L]
----------------------

##Alternative:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_USER_AGENT}".*MSIE 6.0; Windows NT 5.1; SV1.$" [OR]
RewriteCond %{HTTP_USER_AGENT}".*MSIE 6.0; Windows NT 5.1;1813.$"[OR]
RewriteCond %{HTTP_USER_AGENT}"^(?:User-Agent: )?Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.1;(?: SV1|1813)\)$"[OR] 
RewriteCond %{HTTP_USER_AGENT}"MSIE 6.0; Windows NT 5.1; SV1"
RewriteRule ^.* - [F,L]
</IfModule>
_________________

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ".*MSIE 6.0; Windows NT 5.1; SV1.$" [OR]
RewriteCond %{HTTP_USER_AGENT} ".*MSIE 6.0; Windows NT 5.1;1813.$" [OR]
RewriteCond %{HTTP_USER_AGENT} "^(?:User-Agent: )?Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.1;(?: SV1|1813)\)$" [OR] 
RewriteCond %{HTTP_USER_AGENT} "MSIE 6.0; Windows NT 5.1; SV1"
RewriteRule ^.* - [F,L]

# Alternative: # Mozilla 4/5 Browsers:

RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(compatible;\ MSIE\ [3-9]\.[0-9.]+
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(Macintosh;\ .+\)\ \AppleWebKit/[1-9]\.[0-9.]+\ \(KHTML,\ like\ Gecko\)\ \Safari/[0-9]{3,8}$
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(Macintosh;\ I;\ PPC\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(X11;\ U;\ Linux\ i686;\ [a-z]{2}-[A-Z]{2};\ rv:[1-9]\.[0-9.]+\)\ Gecko/Debian-[1-9]\.[0-9.]+-[0-9]+\ Galeon/[2-9]\.[0-9.]+\ \(Debian\ package\ [2-9]\.[0-9.]+-[0-9]+\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(compatible;\ Konqueror/([0-9]+\.)+[0-9]+.+\ 20[0-9]{6}\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(compatible;\ Konqueror/([0-9]+\.)+[0-9]+;\ Linux\)\ \(KHTML,\ like\ Gecko\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ \(.+;\ rv:([0-9]+\.)+[0-9a-z]+\)\ Gecko/20[0-9]{6} 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[4-5]\.[0-9]+\ WebTV/([0-9]+\.)+[0-9]+\ \(compatible;\ MSIE\ [5-9]\.[0-9]+ 
# OthersRewriteCond %{HTTP_USER_AGENT} ^Avant\ Browser\ \(http://www\.avantbrowser\.com\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Microsoft\ Internet\ Explorer/[34]\.[0-9]{1,2} 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/(3\.01¦4\.0)\ \(compatible;\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[3-4]\.[0-9]+\ \[[a-z]{2}\](\ \(.+\))? 
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0\ \(PSP\ \(PlayStation\ Portable\);\ [0-9.]+\)$ 
RewriteCond %{HTTP_USER_AGENT} ^Opera/[5-9]\.[0-9]+ 

## works fine #! 

RewriteCond %{HTTP_USER_AGENT} ^.*Mozilla\/[1-4]\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Chrome\/[1-9]\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Firefox\/[1-9]\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*MSIE\s[1-6]\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Opera* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Mozilla* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*Mozilla\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Chrome* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*Chrome\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Firefox* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*Firefox\/[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*MSIE* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*MSIE\s[1-9][0-9.][0-9.]* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s[0-4]\\.* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s5\\.[3-9]* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s6\\.[4-9]* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s7\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s8\\.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT\s9\\.* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*Windows\sNT* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*Windows\sNT\s[1-9][0-9.][0-9.]* [NC]

IF?
RewriteCond %{HTTP_USER_AGENT} "JDatabaseDriverMysqli" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "JSIMPLEPIEFACTORY" [NC]
RewriteCond %{HTTP:X-FORWARDED-FOR} "JDatabaseDriverMysqli" [NC,OR]
RewriteCond %{HTTP:X-FORWARDED-FOR} "JSIMPLEPIEFACTORY" [NC]
RewriteRule ^.* - [F,L

#Alternative:  Change if what you need:

RewriteCond %{HTTP_USER_AGENT} fakeadressbrowser/1(.+) [NC,OR]

# must be togeher to work:

RewriteCond %{HTTP_REFERER} ^bc.googleusercontent\.com$ [OR,NC]
RewriteCond %{REMOTE_HOST} ^bc.googleusercontent\.com$ [NC]

# thers no good:
RewriteCond %{HTTP_USER_AGENT} ^PycURL [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^research-scan-bot [NC,OR]
RewriteCond %{HTTP_USER_AGENT}^Python-urllib [NC]


#Block Evil robots sites and rippers:
( RewriteBase / )

RewriteCond %{HTTP_USER_AGENT} ^atraxbot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Azureus [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^geohasher [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^PycURL [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Python-urllib [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^research-scan-bot [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Sosospider [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^xenu [NC,OR]

#Block wellknown and robots.txt:

(RewriteEngine On)
RewriteCond %{REQUEST_URI} !/robots.txt$
RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge


Blocking several USER_AGENTs:

RewriteCond %{HTTP_USER_AGENT} BadBot [OR]
RewriteCond %{HTTP_USER_AGENT} EvilScanner [OR]
RewriteCond %{HTTP_USER_AGENT} Fake
RewriteRule .* - [F]
.........................................................
.........................................................
#DIV: HELL -NOT WANTED!

# Anonymousfox:  

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} anonymousfox\.co
RewriteRule ^/(.*)$ /$1 [F]
</IfModule>

# Alternative:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} anonymousfox\.co
RewriteRule ^ - [NC,F,L]
</IfModule>

# Internetvikings.se/com:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} internetvikings\.com
RewriteRule ^/(.*)$ /$1 [F]
</IfModule>

# WordPress URLs You Will See Bots Scan For

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule (wlwmanifest.xml) - [F,L]
RewriteRule (sellers.json) - [NC,F,L]
RewriteRule (wp-content) - [NC,F,L]
RewriteRule (wp-login.php) - [NC,F,L]
RewriteRule (wp-admin) - [NC,F,L]
</IfModule>
 
# Alternative method:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^164\.132\.161\.([2-9]|[1-8][0-9]|9[0-7])$ [OR]
RewriteCond %{REMOTE_ADDR} ^51\.255\.65\.([2-9]|[1-8][0-9]|9[0-7])$
RewriteRule ^.*$ - [F]</IfModule>

# Third Metehod:

DENY FROM 51.222.253.0/26
DENY FROM 54.36.148.0/24
DENY FROM 54.36.149.0/24
DENY FROM 195.154.122.0/24
DENY FROM 195.154.123.0/24
DENY FROM 195.154.126.0/24
DENY FROM 195.154.127.0/24


#ALTERNATIVE:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_USER_AGENT} "rv:40\.0\)\ Gecko/20100101\ Firefox/40\.1$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Wappalyzer" [OR]
RewriteCond %{HTTP_USER_AGENT} "^Chrome" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Firefox" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^IE" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Internet\ Explorer" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^MSIE" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Chrome$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla\ compatible$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d\ \(compatible\)$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\d\.\d\ \(compatible;\)$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Opera$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "compatible.*compatible" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko.*Gecko" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla.*Mozilla" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*MSIE" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\)([a-z|A-Z])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox.*Netscape" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox.*Opera" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Chrome/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Firefox" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*Edge/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE.*rv:" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera.*Trident/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Chrome/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/([a-z]|[A-Z]) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ ([a-z]|[A-Z])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera/([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\ rv:([a-z]|[A-Z])\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/([0-3]|[6-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9]|6[0-9]|7[0-9]|8[0-9]|9[0-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\d\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 5\..*\ NT\ 6\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 5\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 6\..*\ NT\ 6\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 6\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 6\.2" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 6\.2" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ NT\ 6\.3" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ NT\ 10" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 8\..*\ Trident/([0-3]|[5-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 9\..*\ Trident/([0-4]|[6-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ 10\..*\ Trident/([0-5]|[7-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*\ Trident/([0-6]|[8-9]);\ rv:11\.0" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Chrome/99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Chrome/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Firefox/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\ \d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Opera/9\.99" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Opera/\d\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Presto/9" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Trident/\d\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Trident/([0-3]|[8-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:1\..*Firefox/(0|[2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:2\..*Firefox/([0-1]|[2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:3\..*Firefox/([0-2]|[4-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ".*rv:4\..*Firefox/([0-3]|[5-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\ \(Chrome\)" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\(Win/$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "compatible\ ;" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "CAIMEO\ Artificial\ Intelligence" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/\ " [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Gecko/20([2-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "-IE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "\ IE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla\ ([0-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.\d\(" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Mozilla/\d\.\d\ \(\ " [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla$[NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "MSIE\d" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "User\ Agent" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows/" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ ([0-2]|[4-8])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\)" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 0" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 1\." [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ ([2-3]|[7-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 5\.([3-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 6\.([4-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ 10\.([1-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Windows\ NT\ (1[1-9]|4[0-9]|5[0-9]|6[0-9])" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} !Waterfox/\d\d\.
RewriteCond %{HTTP_USER_AGENT} !Waterfox\)
RewriteCond %{HTTP_USER_AGENT} ".*Firefox/\d\d\.\d\."
RewriteCond %{HTTP_USER_AGENT} !Trident/
RewriteCond %{HTTP_USER_AGENT} MSIE\ .*Windows
RewriteCond %{HTTP_USER_AGENT} !PaleMoon/
RewriteCond %{HTTP_USER_AGENT} "Gecko/201([1-9])"
</IfModule>


# Or make your own of these above, depending threats:) take:
<IfModule mod_rewrite.c>
My own list here

</IfModule>
OR: RewriteRule .* - [F]</IfModule>

# BLOCK BAD BOTS START
(RewriteEngine On)

RewriteCond %{REQUEST_URI} !/robots.txt$
RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go\ 1.1\ package.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go-http-client.*$ [NC,OR]

RewriteCond %{REQUEST_URI} !/robots.txt$
RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]

RewriteCond %{HTTP_USER_AGENT} ^.*AppEngine.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Zend_Http_Client.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Nutch.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*larbin.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Nutch.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*CopyRightCheck.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*CCBot.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*libWeb/clsHTTP.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*httplib.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*LinkScan.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*GetRight.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*Flaming\ AttackBot.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*MSIECrawler.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*searchpreview.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*GetRight.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go!Zilla.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go-Ahead-Got-It.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*Image\ Stripper.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Image\ Sucker.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*InterGET.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Internet\ Ninja.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*larbin.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*Mass\ Downloader.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*Offline\ Explorer.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Offline\ Navigator.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PageGrabber.*$ [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^.*libwww.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Python.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*perl.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*urllib.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*scan.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Curl.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PycURL.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Python-urllib.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pyth.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PyQ.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^PerlCrawler [NC,OR]

.......................................................................................
.......................................................................................
# If you got to many of these: 

<IfModule mod_setenvif.c>
SetEnvIfNoCase User-Agent"^Anonymouse.org" bad_bot
SetEnvIfNoCase User-Agent"^Download" bad_bot
SetEnvIfNoCase User-Agent"^Microsoft.URL" bad_bot
SetEnvIfNoCase User-Agent"^Microsoft URL Control" bad_bot
SetEnvIfNoCase User-Agent"^Mozilla/3.Mozilla/2.01" bad_bot
SetEnvIfNoCase User-Agent"^FrontPage" bad_bot
SetEnvIfNoCase User-Agent"^Java.*" bad_bot
SetEnvIfNoCase User-Agent"^Microsoft.URL" bad_bot
SetEnvIfNoCase User-Agen "^MSFrontPage" bad_bot
SetEnvIfNoCase user-Agent"^Offline.Explorer" bad_bot
SetEnvIfNoCase user-Agent"^[Ww]eb[Bb]andit" bad_bot
SetEnvIfNoCase user-Agent"^Zeus" bad_bot
SetEnvIfNoCase User-Agent HeadlessChrome bad_bot
SetEnvIfNoCase User-Agent^$ bad_bot
SetEnvIfNoCase User-Agent.*\@.* bad_bot
SetEnvIfNoCase User-Agent.*bot.* bad_bot
</IfModule>

...
# Alternative to above:

* Bad user Agets: 
SetEnvIfNoCase User-Agent "^xxxxx*" block_bad_bots Deny from env=block_bad_bots
SetEnvIfNoCase User-Agent "^xxxxxx*" block_bad_bots Deny from env=block_bad_bots

Bad webhotels /Bad domains: 
SetEnvIfNoCase Referer "exemple.com" bad_referer Order Allow,Deny Allow from ALL Deny from env=bad_referer
SetEnvIfNoCase Referer "exempel.se" bad_referer Order Allow,Deny Allow from ALL Deny from env=bad_referer

I use this .htaccess:  Works mostly good to stop these thieves:

BrowserMatch "^-?$" badbots
BrowserMatchNoCase "exempel.com"badbots
Deny from env=badbots

If....:)

SetEnvIfNoCase Referer "exempel.se" bad_referer Order Allow,Deny Allow from ALL Deny from env=bad_referer

# Bad domain:

SetEnvIfNoCase Referer "problemdomain.com" bad_referer Order Allow,Deny Allow from ALL Deny from env=bad_referer

# ALTERNATIVE:  (maybe blocks bing and so on, try and see if it works!)

SetEnvIfNoCase User-Agent ([a-z0-9]{2000,}) bad_bot

# Stop bots from accessing certain pages: (change it to pages you do not want any bots on)

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (bot|slurp|spider|crawler) [NC]
RewriteCond %{REQUEST_URI} ^/tng/calendar.php [OR]
RewriteCond %{REQUEST_URI} ^/tng/guestbook.php [OR]
RewriteCond %{REQUEST_URI} ^/tng/familychart.php
RewriteRule ^.*$ - [F]</IfModule>

# If:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule (.+)/feed /$1 [R=301,L]
RewriteRule (.+)/attachment /$1 [R=301,L]
RewriteRule (.+)/comment-page /$1 [R=301,L]
RewriteRule (.+)/comments /$1 [R=301,L]
RewriteRule (.+)/trackback /$1 [R=301,L]
RewriteRule ^.* - [F,L]</IfModule>

# Another metod to stop seo cheking bots, that you don´t want! (if your not using BBQ):

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {HTTP_USER_AGENT} ^.*(Ahrefs|MJ12bot|Seznam|SemrushBot|DotBot|spbot).*$ [NC]
RewriteRule .* - [F,L]</IfModule>


# Anther  Metood:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} "^$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Maxthon$" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Acunetix" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^DISCo" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Download Demon" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Express WebPictures" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^FHscan" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Go\-Ahead\-Got\-It" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^HMView" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "check_httpcurl" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Image Stripper" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^Image Sucker" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Mobile/9B206 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^PageGrabber" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "Security Scan" [NC]
RewriteCond %{HTTP_USER_AGENT} "^Web Image Collector" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "^WPScan" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^WordPress [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "PHPCrawl" [NC,OR]
RewriteRule ^.* - [F,L]
</IfModule>

Refer>
SetEnvIfNoCase Referer "^$bad_user  

.......................................................................................
.......................................................................................
# Validate Googlebots:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/5\.0\ \(compatible;\ Googlebot/2\.[01];\ \+http://www\.google\.com/bot\.html\)$
RewriteCond %{HTTP:Accept} ^\*/\*$
RewriteCond %{HTTP:Accept-Encoding} ="gzip,deflate"
RewriteCond %{HTTP:Accept-Language} =""
RewriteCond %{HTTP:Accept-Charset} =""
RewriteCond %{HTTP:From} ="googlebot(at)googlebot.com"
RewriteCond %{REMOTE_ADDR} ^66\.249\.(6[4-9]|7[0-9]|8[0-46-9]|9[0-5])\. [OR]
RewriteCond %{REMOTE_ADDR} ^216\.239\.(3[2-9]|[45][0-9]|6[0-3])\.0RewriteCond %{REMOTE_HOST} ^crawl(-([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-5])){4}\.googlebot\.com$
RewriteRule ^ - [S=1]
RewriteCond %{HTTP_USER_AGENT} Googlebot [NC]
RewriteRule ^ - [F]

# IF you only wants: google bots!

RewriteCond%{REMOTE_ADDR} !^64\.249\.RewriteCond %{HTTP_USER_AGENT} Googlebot RewriteRule .* - [F] 

# False google bots:

deny from 76.73.0.0/17 deny from 76.73.0.*deny from 76.73.*.*deny from 76.*.*.*allow from all

.......................................................................................
.......................................................................................
# Not always working, but try it! # Prevent image hotlinking

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond% {HTTP_REFERER} !^$
RewriteCond% {HTTP_REFERER} !^http(s)?://(www\.)?exemple.se [NC]
RewriteCond% {HTTP_REFERER} !^http(s)?://(www\.)?google.com [NC]
RewriteCond% {HTTP_REFERER} !^http(s)?://(www\.)?facebook.com [NC]
RewriteCond% {HTTP_REFERER} !^http(s)?://(www\.)?instagram.com [NC]
RewriteRule \.(jpg|jpeg|png|gif|svg)$ https://deinedomain.com/hotlink-image.jpg [NC,R,L]
RewriteRule ^.* - [F,L]</IfModule>

.......................................................................................
.......................................................................................
# If problem with Poker and so on:

SetEnvIfNoCase Referer doobu.com spammer=yes
SetEnvIfNoCase Referer poker spammer=yes
Order allow,deny
allow from all
deny from env=spammer

.......................................................................................
.......................................................................................
# There are reasons you may want to prevent anyone who are not coming from your site from posting to your site:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {REQUEST_METHOD} POST
RewriteCond% {HTTP_REFERER} !^http://www.urltoyoursite.com [NC]
RewriteRule .* - [F]</IfModule>

.......................................................................................
.......................................................................................
# STOP SPAM:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteEngine On 
RewriteCond% {REQUEST_METHOD} POST 
RewriteCond% {REQUEST_URI} .wp-comments-post\.php* 
RewriteCond% {HTTP_REFERER} !.*yourblog.com.* [OR] 
RewriteCond% {HTTP_USER_AGENT} ^$ 
RewriteRule (.*)^https://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

ALTERNATIVE:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php*
RewriteCond %{HTTP_REFERER} !.*exempel\.se.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$^https://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# Block spam that targets wp-comments-post.php & wp-login.php by denying access to no-referrer requests- Works very well!

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {REQUEST_METHOD} POST
RewriteCond% {REQUEST_URI} .(wp-comments-post|wp-login)\.php*
RewriteCond% {HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$ ^https://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# This allows GET and POST and disable HTTP/1.0. It also disables proxy requests:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} !^(POST|GET)\ /.*\ HTTP/1\.1$ 
RewriteRule .* - [F]</IfModule>
 
 
# No WP spam Alternative:

RewriteCond %{REQUEST_URI} ^/wp-login.php$
RewriteRule .* - [F]

#  Protect all Js & css files on the wp:

PROTECT:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule !\.(css|js)$ index.php [L]
<IfModule mod_rewrite.c>

.......................................................................................
.......................................................................................
# If you are tired of a hacker who always tryes to get in.....

<IfModule mod_rewrite.c>
RewriteCond %{REMOTE_ADDR} ^$
RewriteRule (.*) /https://exempel.se / [R=301,L]
</IfModule>

- I always sends them to the toilet on centralstation.....:)

# Tired of one specific  spammer? Send him some else:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {REQUEST_METHOD} POST
RewriteCond% {REQUEST_URI} .wp-comments-post\.php*
RewriteCond% {HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$ ^http://the-site-where-you-want-to-send-spammers.com/$ [R=301,L]
</IfModule>

# 500 Internal Server Error for anyone linking from the target domain:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {HTTP_REFERER} example\.com [NC,OR]
RewriteRule .* - [F]</IfModule>

# REDIRECT SPAMMER ATTACKS TO BOGUS SITE:

<IfModule mod_rewrite.c>
RewriteCond %{QUERY_STRING} q=user/register
RewriteRule ^/?$ https://iczxmlqar.com/ [R=301,L]
RewriteCond %{QUERY_STRING} q=node/add
RewriteRule ^/?$ https://iczxmlqar.com/ [R=301,L]
</IfModule>

.......................................................................................
.......................................................................................
# Denies any comment attempt with a blank HTTP_REFERER field, highly indicative of spam. 
May prevent some visitors from POSTING. [403]

<IfModule mod_rewrite.c>
RewriteCond% {THE_REQUEST} ^[A-Z]{3,9}\ /.*/wp-comments-post\.php.*\ HTTP/ [NC]
RewriteCond% {HTTP_REFERER} ^-?$
RewriteRule .* - [F,NS,L]</IfModule>

.......................................................................................
.......................................................................................
# GET head:

RewriteCond %{HTTP_REFERER} ^-?$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^bot [OR,NC]
RewriteCond %{REQUEST_METHOD} !^HEAD$ [OR,NC] 
RewriteCond %{REQUEST_URI} !^/robots\.txt [NC]
RewriteRule ^ - [F,L]

.......................................................................................
.......................................................................................
# Deny access to hidden files or directories by using:

<IfModule mod_rewrite.c>
RewriteCond% {SCRIPT_FILENAME} -d [OR]
RewriteCond% {SCRIPT_FILENAME]</IfModule>} -f
RewriteRule “(^|/)\.” – [F]

.
# ALTERNATIVE:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteEngine on RewriteRule (^\.|/\.) - [F]
</IfModule>

# Alternatively, you can just raise a “Not Found” error, giving the attacker no clue:

RedirectMatch 404 /\..*$

.......................................................................................
.......................................................................................
# If you got git in your site:

<DirectoryMatch "^/.*/\.git/">Deny from all</Directorymatch>

.......................................................................................
........................................................................................

# If you're using cPanel AutoSSL or the Let's Encrypt webroot method to create your 
SSL certificates, it will fail to validate the certificate if validation 
requests are redirected to HTTPS. Turn on the condition(s) you need.

<IfModule mod_rewrite.c> 
RewriteEngine On
RewriteCond% {HTTPS} !=on
RewriteCond% {REQUEST_URI} !^/\.well-known/acme-challenge/
RewriteCond% {REQUEST_URI} !^/\.well-known/cpanel-dcv/[\w-]+$
RewriteCond% {REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

.......................................................................................
.......................................................................................
* If you got comments or shop/getting spam -this might work:

<IfModule mod_rewrite.c>
RewriteEngine On 
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?adult(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?anal(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?blow.?job(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?gay(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?cum+shot(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?casino(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?incest(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?mature(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?nude(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?piss(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?porn(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?pus*y(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?sex(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?teen(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?tits(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?titten(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?wichsab(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?.*(-|.)?wichslos(-|.).*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?xmaster.*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://www14\.blogspot.*$ [OR]
RewriteCond% {HTTP_REFERER} ^http://(www\.)?yahh+oo.*$
RewriteCond% {HTTP_USER_AGENT} ^DISCo [OR]
RewriteCond% {HTTP_USER_AGENT} ^DISCo\ Pump [OR]
RewriteRule .* - [F,L]</IfModule>

# Alternative:
RewriteCond %{HTTP_REFERER} (-anal) [NC,OR]

RewriteCond %{HTTP_REFERER} (-cock) [NC,OR]

RewriteCond %{HTTP_REFERER} (-orgy) [NC,OR]

RewriteCond %{HTTP_REFERER} (-porn-) [NC,OR]

RewriteCond %{HTTP_REFERER} (-sex-) [NC,OR]

RewriteCond %{HTTP_REFERER} (-sex.) [NC,OR]

# Alternative for poker and porn:

<IfModule mod_rewrite.c>
RewriteEngine On 
RewriteEngine on
RewriteCond %{HTTP_REFERER} \bporn\b [NC,OR]
RewriteCond %{HTTP_REFERER} \bpill\b [NC,OR]
RewriteCond %{HTTP_REFERER} \bpoker\b [NC]
RewriteRule .* - [F]</IfModule>

# Alternative:
RewriteCond %{HTTP_REFERER} (-poker.) [NC,OR]

# Your own:
RewriteCond %{HTTP_REFERER} (-name.) [NC,OR]

.......................................................................................
.......................................................................................
# Return 404 if original request is file.php

Put it on your long list of: RewriteCond% list:
RewriteCond% {THE_REQUEST} "^[^ ]*.*?\.php[? ].*$" RewriteRule .* - [L,R=404]

ALTERNATIVE: 
RewriteCond% {REQUEST_FILENAME}\.php$

ALTERNATIVE: 
<IfModule mod_rewrite.c>RewriteCond% {THE_REQUEST} "^[^ ]*.*?\.php[? ].*$"
RewriteRule .* - [L,R=404]</IfModule>

ALTERNATIVE: 
RewriteCond% {REQUEST_FILENAME}\.php$

.......................................................................................
.......................................................................................
# Alternative: Deny access to certain directories that SHOULD NOT be exposed.

<IfModule mod_rewrite.c>
RewriteRule (^|/)\.git - [L,R=403]
RewriteRule ^cgi-bin/ - [L,R=403]
RewriteRule ^uploads/import/ - [L,R=403]
RewriteRule ^vendor/ - [L,R=403]
RewriteRule ^wp-config - [L,R=404]
RewriteRule ^wp-cron\.php - [L,R=404]
RewriteRule ^wp-links-opml\.php$ - [L,R=404]
RewriteRule ^wp-admin/(install|setup-config|upgrade)\.php - [L,R=404]
RewriteRule ^wp-admin/maint/repair\.php - [L,R=404]
RewriteRule ^wp-content/(plugins|themes)/(.+)/$ - [L,R=404]
</IfModule>


#Alternative / ADMIN: (if you use my htaccess for admin- you are safe!

<Files admin-ajax.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files
<Files install.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files

.......................................................................................
.......................................................................................
#USER INI:

RewriteRule \.user\.ini$ - [F,L,NC]

or:

<Files ".user.ini"><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>
.......................................................................................
.......................................................................................
## Registration is disabled so... If you do not want; sign up/register within´your blog.
## Deny access to wp-signup.php and wp-register.php

<IfModule mod_rewrite.c>
RewriteCond%{REQUEST_URI}wp-signup\.php[NC,OR]
RewriteCond%{QUERY_STRING}wp-signup\.php[NC,OR]
RewriteCond%{THE_REQUEST}wp-signup\.php[NC,OR]
RewriteCond%{REQUEST_URI}wp-register\.php[NC,OR]
RewriteCond%{QUERY_STRING}wp-register\.php[NC,OR]
RewriteCond%{THE_REQUEST}wp-register\.php[NC]
RewriteRule.*-[F,NS,L]</IfModule>
.
Alternative (add to BBQ):
#BLOCK SPAM REGISTRATION REQUESTS: 

wp-login.php?action=register

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(wp-login.php\?action=register).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

.......................................................................................
.......................................................................................
# LFI and session hijacking

<IfModule mod_rewrite.c>
RewriteCond% {QUERY_STRING} \=(\.\./\.\.//?)+ [OR]
RewriteCond% {QUERY_STRING} \=(\.\.//\./?)+ [OR]
RewriteCond% {QUERY_STRING} \=(\.\.\\\.\./?)+ [OR]
RewriteCond% {QUERY_STRING} \=(\.\.\\\\\./?)+ [OR]
RewriteCond% {QUERY_STRING} \/tmp\/sess_ [NC,OR]
RewriteCond% {QUERY_STRING} php:\/\/filter\/read=convert\.base64-(en|de)code\/ [NC,OR]
</ifModule>

.......................................................................................
.......................................................................................
# Others:

<IfModule mod_rewrite.c>
RewriteCond% {REQUEST_METHOD} (GET|POST) [NC]
RewriteCond% {QUERY_STRING} ^(.*)(%20SELECT%20|%20INSERT%20|CHAR\(|%20UPDATE%20|%20REPLACE%20)(.*)$ [NC]
RewriteCond% {REQUEST_METHOD} (GET|POST) [NC]
RewriteCond% {QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ftp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ht%20tp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)htt%20p(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%20(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)h%20ttp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC,OR]
RewriteCond% {HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC,OR]
RewriteCond% {REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]</ifModule>

.......................................................................................
.......................................................................................
# GET

<IfModule mod_rewrite.c>
RewriteCond% {REQUEST_METHOD} (GET) [NC]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
RewriteCond% {QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http(%3A|:)(/|%2F){2}(.*)$ [NC]
RewriteRule .* - [F]</ifModule>

.......................................................................................
....................................................................................... 
### If you are tired of those download everything:  
add this with in your content folder /Or uploads folder:

# In uploads folders .htacces:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond% {HTTP:Origin}!^$|http(s)?://(www\.)?exempel.se\.(se|local)$ [NC]
RewriteRule \.(png|xls|pdf|jpeg|jpg|gif|bmp|pdf|doc|xml|jpe?g|gif|tiff)$ - [NC,L]
RewriteCond% {HTTP_REFERER}!.
RewriteRule \.(png|xls|pdf|jpeg|jpg|gif|bmp|pdf|doc|xml|jpe?g|gif|tiff)$ - [F,NC,L]
</IfModule>
 

IF NEEDED: ADD Whateaver you have:

Document: .pdf, .doc, .docx, .ppt, .pptx, .pps, .ppsx, .odt, .xls, .xlsx, .psd
Images: .jpg, .jpeg, .png, .gif, .webp, .ico
Video: .mp4, .m4v, .mov, .wmv, .avi, .mpg, .ogv, .3gp, .3g2
Audio: .mp3, .m4a, .ogg, .wav

#STOP Access to: block access to image files - files with jpg/gif/png/jpeg extensions

<FilesMatch "\.(jpg|gif|png|jpeg)$">Order Allow,Deny Deny from all </FilesMatch>


#block access to image files - files with jpg/gif/png/jpeg extensions

<FilesMatch "\.(jpg|gif|png|jpeg)$">
Order Allow,Deny 
Deny from all 
</FilesMatc>

# To hide some filetypes only, use:
# Hide files of type .png, .zip, .jpg, .gif and .doc from listing: 

IndexIgnore*.png *.zip *.jpg *.gif *.doc

# Deny listing of:

IndexIgnore* .htaccess */.??* *~ *# */HEADER* */README* */_vti*

# Can mybe stop your files to be seen on the blog, try and se!

<FilesMatch "\.(gif|jpg|js|txt|mp4)$">
Require all denied
</FilesMatch>

# Deny all: .htaccess inside root/uploads/

<FilesMatch ".*">
    Order Allow,Deny
    Deny from All
</FilesMatch>

# Disallowing blank referrers will means blocking them from accessing these images:

RewriteCond%{HTTP_REFERER}!^$

Images theft:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !=""
RewriteCond %{HTTP_REFERER} !example\.com [NC]
RewriteCond %{REQUEST_URI} !=/images/go_away.png
RewriteRule \.(jpe?g|gif|png)$ /images/go_away.png [NC,L]

.......................................................................................
.......................................................................................
# ALTERNATIVE Protection, uploads/content folder:
# FORBID THESE FILE EXTENSIONS FROM BEING ACCESSED OR EXECUTED REMOTELY:

<FilesMatch "\.(7z|as|bat|bin|cgi|chm|chml|class|cmd|com|command|dat|db|db2|db3|dba|dll|
DS_Store|exe|gz|hta|htaccess|htc|htx|idc|ini|ins|isp|jar|jav|java|jse|jsfl|json|jsp|jsx|lib|
lnk|out|php|phps|php5|php4|php3|phtml|phpt|pl|py|pyd|pyc|pyo|rar|shtm|shtml|sql|sys|tar|taz|tgz|tpl|vb|vbe|vbs|war|ws|wsf|xhtml|xml|z)$">
Order Deny,Allow Deny from all RewriteCond%{HTTP_REFERER}!^$


# Restrict the type of executable files and display
To protect the security of your site's information and data, some of 
the extensions can be blocked on the site to prevent them from running. 
To do this, you can enter the following code in your Htaccess file.

RewriteEngine On
rewritecond% {REQUEST_FILENAME}! ^ (. +). css $
rewritecond% {REQUEST_FILENAME}! ^ (. +) .js $
rewritecond% {REQUEST_FILENAME}! file.php $
RewriteRule ^ (. +) $ / Deny / [nc]

# Prevent Direct File Download in Apache Server  // Not  alwaysworking ,try and see!

<filesmatch ".*"="">
    Order Allow,Deny
    Deny from All
</filesmatch>

# Banning the download of dotfiles:

<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

#BLOCK: downloads###:
RewriteCond %{HTTP_HOST}@@%{HTTP_REFERER} !^([^@]*)@@https?://\1/.*
RewriteRule \.(gif|jpg|jpeg|png|tif|pdf|wav|wmv|wma|avi|mov|mp4|m4v|mp3|zip?)$ - [F]

# Prevent Downloading/ include n your root folder:
Sometimes you want to force the browser to display some content instead of downloading it.

<FilesMatch "\.(ico|jpg|txt)$">
Header set Content-Type text/plain
</FilesMatch>

Just change ico to .... so on to your needs!

# THEME Alternative Protection:

RewriteRule !^.js|.min.js|json|css|.min.css|.css|xml|.php|js|php\.php$ - [F,L]

ALT2:
<Files ~"\.(js|css|php)$">order allow,deny deny from all</Files>

Alternative to above:
<Files ~"\.(js|min.js|css|min.css)$">order allow,deny deny from all</Files>

ALT 3:
<IfModule mod_rewrite.c>
RewriteRule ^theme/(.*)$ /wp-content/themes/yourtheme/$1 [L]
RewriteRule ^wp-content/themes/mytheme/$ /the/page/not-found [L]</IfModule>

ALT4:
<IfModule mod_rewrite.c>
RewriteCond%{REQUEST_URI}^.*/wp-content/themes/.*[NC,OR]
RewriteCond%{THE_REQUEST}^.*/wp-content/themes/.*[NC]
RewriteRule.*-[F,L]</IfModule>

........................................................................................
........................................................................................
# MS/ Multi site files protection:

<Files  ms-files.php><IfModule !mod_authz_core.c>Allow from all</IfModule><IfModule mod_authz_core.c>Require all granted</IfModule></Files>

# MU plugins:
RewriteRule ^wp-content/mu-plugins/$ - [L,R=404]

# Network|Multisite Signup POST Form Requests

RewriteCond %{REQUEST_URI} !^.*/wp-signup.php [NC]

# Network|Multisite Activate POST Form Requests

RewriteCond %{REQUEST_URI} !^.*/wp-activate.php [NC]

........................................................................................
........................................................................................
# DENY access to all PHP/CSS files in Some directory - Add .htaccess in the folder you want it:

<Files *.php>deny from all</Files>

<Files ~ "[^/]\{0,}\.(php|css)$">Order deny,allow Deny from all</Files>

Apache 2.4+:
<Files ~ "[^/]\{0,}\.(|min.js|css|min.css)$">Require all denied</Files>

............
Alternative: Only php files:

<FilesMatch "\.php$">Order deny,allow Deny from all</FilesMatch>

Apache 2.4+:

<Files ~ "[^/]\{0,}\.(|min.js|css|min.css)$">Require all denied</Files>

Alternative: Only Js files:

<FilesMatch "\.js$">Order deny,allow Deny from all</FilesMatch>

Apache 2.4:
<Files ~"\.(js|min.js|css|min.css)$">Require all denied</Files>

# JS:
<FilesMatch "\.(js|min.js)$">Require all denied</FilesMatch> 

# Backdoor Protection Apache 2.4+: (uploads):

<FilesMatch “.+\.php$”>Require all denied</FilesMatch> 

........................................................................................
........................................................................................
# PHP info file protect:

<Files  php-info.php>
Order Deny,Allow
Deny from all
Allow from MY IP ADRESS
</Files>

.......................................................................................
.......................................................................................
# PHP-CGI Vulnerability

<IfModule mod_rewrite.c>
RewriteCond% {QUERY_STRING}^(%2d|-)[^=]+$[NC,OR]
RewriteCond% {QUERY_STRING}(sp_executesql)[NC]
RewriteRule ^(.*)$ - [F,L]/ifModule>

.......................................................................................
.......................................................................................
# Protect wp-login.php from Brute Force Login Attacks based on IP Address: If needed, if you have diffrent ip adresses it won´t work good.

<FilesMatch "^(wp-login\.php)">
Order Allow,Deny
Allow from IP ADRESS xxxxxx
</FilesMatch>

.......................................................................................
.......................................................................................
* Simply place the commands below in the .htaccess file of your website root folder to remove .php extensions.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST}/([^.]+).php [NC]
RewriteRule ^ /%1 [NC,L,R]
RewriteCond %{REQUEST_FILENAME}!-f
RewriteRule ^([^.]+)$ $1.php[NC,L]
</ifModule>

.......................................................................................
.......................................................................................
# No UserAgent, Not POST
Denies POST requests by blank user-agents. May prevent a small number of visitors from POSTING. 

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteRule .* - [F,NS,L]</ifModule>

# Alternative:  No User-Agent? No posting

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F]</ifModule>

.......................................................................................
.......................................................................................
# DENY from IP Adress:

Deny from xx.xx.xx.xxx

# Apache 2.4+

require all denied require ip

# OR:
Require not host phishers.example.com moreidiots.example
........................................................................................
........................................................................................
# Block HTTP access to all files in a directory?:  // can break site,try and se!

<Files *>Deny from all</Files>

# ALTERNATIVE:

<IfModule mod_authz_core.c>
Require all denied
</IfModule>

# Apache 2.4+

require all denied 

........................................................................................
........................................................................................
# Deny access to filenames starting with dot(.) (.htaccess)

<FilesMatch "^\.">Order allow,deny Deny from all</FilesMatch>

........................................................................................
........................................................................................
# WordPress – prevent access to: (php files)

<Files *.php>deny from all</Files>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-includes/[^/]*\.php$ - [R=403,L]
</IfModule>


#  Apache + 2,4:  (be careful -mat break some files!)

<Files ~ ".*..*">Require all denied</Files>
........................................................................................
........................................................................................
# DENY access to log files:

RewriteRule ^wp-where I have the log/(.*\.log)$ - [R=404,L]

..............................................................
# XML FILES: If you got some more somewhere:

RewriteRule ^yourfile.xml$ 404.html

........................................................................................
........................................................................................
# Deny access to all .log and .comment files:

<Files ~ "^.*\.([Ll][Oo][Gg]|[cC][oO][mM][mM][eE][nN][tT])">
........................................................................................
........................................................................................
# USER: Block User ID Phishing Requests:

<IfModule mod_rewrite.c>
RewriteCond %{QUERY_STRING} ^author=([0-9]*)
RewriteRule .* - [L,F]
#RewriteRule .* http://example.com/? [L,R=302]
</IfModule>

........................................................................................
........................................................................................
# Allow file:

<Files "your-file-name.php">Allow from all</Files>

........................................................................................
........................................................................................
# Deny folder access:

<IfModule>mod_rewrite.c>RewriteEngine On RewriteRule ^.* - [R=404,L]</IfModule>

........................................................................................
........................................................................................
# Redirect:

Redirect 301 /oldurl1/ https://www.yoursite.com/newurl1/
Redirect 301 /oldurl2/ https://www.yoursite.com/newurl2/

........................................................................................
........................................................................................
# WordPress uploads folder (YOUR_SITE/wp-content/uploads/), 
which should only contain media files in order to prevent any .php files from executing.
Do not always work, tryand se first! 

<FilesMatch "(?i)\.(php|php5?|phtml)$">Order Deny,Allow Deny from All</FilesMatch>

PHP 8:
<FilesMatch "(?i)\.(php|php8?|phtml)$">Order Deny,Allow Deny from All</FilesMatch>

........................................................................................
........................................................................................
# Eliminate favion crawling - if too much of that! //wp-content folder.

< IfModule mod_rewrite.c >
RewriteEngine On
RewriteBase /
RewriteCond% {REQUEST_URI}/favicon?\.?(gif|ico|jpe?g?|png)?$ [NC]
RewriteRule (.*) https://your-site.com/favicon.ico [R=301,L]
</IfModule>

........................................................................................
........................................................................................
# Locks css/js to domain: (only if you are under attack! cannot use tinymce, but if you don´t use it..:) 
< IfModule mod_rewrite.c >
RewriteEngine On
RewriteBase /
RewriteCond% {HTTP_REFERER} !^http(s)?://(.+\.)?mysite\.com/ [NC]
RewriteRule .*\.(js|css)$ - [NC,F,L]
</IfModule>

........................................................................................
........................................................................................
# Protection for Lib-pearl:

RewriteCond% {HTTP_USER_AGENT} libwww-perl.* RewriteRule .* ? [F,L]

........................................................................................
........................................................................................
# Block Semalt (semalt.com) Referrer Spam:

RewriteCond%{HTTP_REFERER}semalt\.semalt\.com [NC]

........................................................................................
........................................................................................
# SUBSTITUTE WEBP IF POSSIBLE
# IF VISITOR'S BROWSER SUPPORTS WEBP IMAGES, AND A WEBP IMAGE EXISTS NEXT TO THE JPG, SERVE THE WEBP IMAGE INSTEAD.
OBS! not always working!

<IfModule mod_setenvif.c>
SetEnvIf Request_URI "\.(jpe?g|png)$" REQUEST_image
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_ACCEPT} image/webp
RewriteCond %{DOCUMENT_ROOT}/$1.webp -f
RewriteRule (.+)\.(jpe?g|png)$ $1.webp [T=image/webp]
</IfModule>
<IfModule mod_headers.c>
Header append Vary Accept env=REQUEST_image
</IfModule>
<IfModule mod_mime.c>
AddType image/webp .webp
</IfModule>

....

# WEBP SUBSTITUTION CODE FOR THE "EWWW IMAGE OPTIMIZER" PLUGIN
# Used with: https://en-ca.wordpress.org/plugins/ewww-image-optimizer/

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_ACCEPT} image/webp
RewriteCond %{REQUEST_FILENAME} (.*)\.(jpe?g|png)$
RewriteCond %{REQUEST_FILENAME}\.webp -f
RewriteCond %{QUERY_STRING} !type=original
RewriteRule (.+)\.(jpe?g|png)$ %{REQUEST_FILENAME}.webp [T=image/webp,E=accept:1,L]
</IfModule>
<IfModule mod_headers.c>
Header append Vary Accept env=REDIRECT_accept
</IfModule>
AddType image/webp .webp


# Alternative:
<IfModule pagespeed_module>
ModPagespeed on
ModPagespeedEnableFilters rewrite_css,combine_css
ModPagespeedEnableFilters rewrite_js,combine_js
ModPagespeedEnableFilters recompress_images
ModPagespeedEnableFilters convert_png_to_jpeg,convert_jpeg_to_webp
ModPagespeedEnableFilters collapse_whitespace,remove_comments
</IfModule>

# BROTOLI COMPRESSION:  Better than GZIP, but not on every webhotell.

<IfModule mod_brotli.c>
<IfModule mod_filter.c>
AddOutputFilterByType BROTLI_COMPRESS text/html text/xml text/plain
AddOutputFilterByType BROTLI_COMPRESS application/rss+xml application/xml application/xhtml+xml
AddOutputFilterByType BROTLI_COMPRESS text/css
AddOutputFilterByType BROTLI_COMPRESS text/javascript application/javascript application/x-javascript
AddOutputFilterByType BROTLI_COMPRESS image/x-icon image/svg+xml
AddOutputFilterByType BROTLI_COMPRESS application/rss+xml
AddOutputFilterByType BROTLI_COMPRESS application/font application/font-truetype application/font-ttf
AddOutputFilterByType BROTLI_COMPRESS application/font-otf application/font-opentype
AddOutputFilterByType BROTLI_COMPRESS application/font-woff application/font-woff2
AddOutputFilterByType BROTLI_COMPRESS application/vnd.ms-fontobject
AddOutputFilterByType BROTLI_COMPRESS font/ttf font/otf font/opentype font/woff font/woff2
</IfModule>
</IfModule>
<IfModule mod_deflate.c>
<IfModule mod_filter.c>
AddOutputFilterByType DEFLATE text/html text/xml text/plain
AddOutputFilterByType DEFLATE application/rss+xml application/xml application/xhtml+xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript
AddOutputFilterByType DEFLATE image/x-icon image/svg+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/font application/font-truetype application/font-ttf
AddOutputFilterByType DEFLATE application/font-otf application/font-opentype
AddOutputFilterByType DEFLATE application/font-woff application/font-woff2
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
AddOutputFilterByType DEFLATE font/ttf font/otf font/opentype font/woff font/woff2
</IfModule>
</IfModule>
<IfModule mod_rewrite.c>
RewriteRule "\.(gz|br)$" "-" [E=no-gzip:1,E=no-brotli:1]
</IfModule>
<IfModule !mod_rewrite.c>
<IfModule mod_setenvif.c>
SetEnvIfNoCase Request_URI \.(gz|br)$ no-gzip no-brotli
</IfModule>
</IfModule>

........................................................................................
........................................................................................ 
# Alternative GZIP Compression:
 
 <IfModule !mod_filter.c>
AddOutputFilterByType DEFLATE text/html text/css text/plain
AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
AddOutputFilterByType DEFLATE application/xhtml+xml application/xslt+xml application/rss+xml application/atom+xml
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE application/javascript application/json application/x-javascript text/ecmascript text/javascript
AddOutputFilterByType DEFLATE image/vnd.microsoft.icon image/x-icon image/bmp image/tiff
AddOutputFilterByType DEFLATE application/pdf
AddOutputFilterByType DEFLATE font/opentype application/x-font-ttf application/vnd.ms-fontobject
</IfModule>
</IfModule>

<IfModule mod_deflate.c>
<IfModule mod_setenvif.c>
<IfModule mod_headers.c>
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s,?\s(gzip|deflate)?|X{4,13}|~{4,13}|-{4,13})$ HAVE_Accept-Encoding
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
</IfModule>
</IfModule>
<IfModule filter_module>
FilterDeclare   COMPRESS
FilterProvider  COMPRESS  DEFLATE resp=Content-Type /text/(html|css|javascript|plain|x(ml|-component))/
FilterProvider  COMPRESS  DEFLATE resp=Content-Type /application/(javascript|json|xml|x-javascript)/
FilterChain     COMPRESS
FilterProtocol  COMPRESS  change=yes;byteranges=no
</IfModule>
<IfModule !mod_filter.c>
AddOutputFilterByType DEFLATE text/text text/html text/plain text/css application/json
AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript 
AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
</IfModule>
<FilesMatch "\.(ttf|otf|eot|svg|php)$" >
SetOutputFilter DEFLATE
</FilesMatch>
</IfModule>

# More compression, if needed:

<ifModule mod_deflate.c>
<filesMatch "\.(css|js|x?html?|php)$">
SetOutputFilter DEFLATE
</filesMatch>
</ifModule>

# Try this:

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE application/javascript text/css
</IfModule>

#  COMBINE CSS, COMPRESS IMAGES, REMOVE HTML WHITE SPACE AND COMMENTS

<IfModule pagespeed_module>
ModPagespeed on
ModPagespeedEnableFilters rewrite_css,combine_css
ModPagespeedEnableFilters recompress_images
ModPagespeedEnableFilters convert_png_to_jpeg,convert_jpeg_to_webp
ModPagespeedEnableFilters collapse_whitespace,remove_comments
</IfModule>
# TN — ENABLE MOD PAGESPEED END

# FONTS:

<IfModule mod_deflate.c>
SetOutputFilter DEFLATE
<IfModule mod_filter.c>
AddOutputFilterByType DEFLATE application/font-otf application/font-ttf application/font-woff application/javascript application/json application/manifest+json application/rss+xml application/vnd.ms-fontobject application/xhtml+xml application/xml application/x-javascript image/svg+xml text/css text/csv text/html text/javascript text/plain text/xml
</IfModule>
</IfModule>

# OR:

RewriteRule ^.*.(?:css|js)$ $0.gz [L,QSA]

# Compress js/css:

files *.js.gz>
AddType "text/javascript" .gz
AddEncoding gzip .gz
</files>
<files *.css.gz>
AddType "text/css" .gz
AddEncoding gzip .gz
</files>

#:

<FilesMatch *.(html|css|jpg|jpeg|png|gif|js|ico)>
SetOutputFilter DEFLATE
</FilesMatch>

# OR:

<IfModule mod_headers.c>
RewriteCond "%{HTTP:Accept-encoding}" "gzip"
RewriteCond "%{REQUEST_FILENAME}\.gz" -s
RewriteRule "^(.*)\.(css|js)" "$1\.$2\.gz" [QSA]
RewriteRule "\.css\.gz$" "-" [T=text/css,E=no-gzip:1]
RewriteRule "\.js\.gz$"  "-" [T=text/javascript,E=no-gzip:1]
<FilesMatch "(\.js\.gz|\.css\.gz)$">
Header append Content-Encoding gzip
Header append Vary Accept-Encoding
</FilesMatch>
</IfModule>

# OR:

<IfModule mod_headers.c>
<FilesMatch ".(js|css|xml|gz|html)$">
Header append Vary: Accept-Encoding
</FilesMatch>
</IfModule>

# OR:

<IfModule mod_headers.c>
<FilesMatch "\.(js|css|xml|gz)$">
Header append Vary: Accept-Encoding
</FilesMatch>
</IfModule>


# OR:

</IfModule>
<FilesMatch "\.js$">
RewriteEngine On
RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{REQUEST_FILENAME}.gz -f
RewriteRule (.*)\.js$ $1\.js.gz [L]
ForceType text/javascript
</FilesMatch>
<FilesMatch "\.js\.gz$">
ForceType text/javascript
Header set Content-Encoding gzip
Header set Vary Accept-Encoding
</FilesMatch>

# FONTS:
<IfModule mod_mime.c>
AddType application/vnd.ms-fontobject  eot
AddType application/x-font-ttf   ttf ttc
AddType font/opentype  otf
AddType application/x-font-woff  woff woff2
AddType image/svg+xml  svg svgz
AddEncoding gzip  svgz
</IfModule>

# Headers.
<IfModule mod_headers.c>
RewriteCond "%{HTTP:Accept-encoding}" "gzip"
RewriteCond "%{REQUEST_FILENAME}\.gz" -s
<FilesMatch "(\.js\.gz|\.css\.gz)$">
Header append Content-Encoding gzip
Header append Vary Accept-Encoding
</FilesMatch>
</IfModule>


## Audio files expiration: 1 month after request:

ExpiresByType audio/ogg "now plus 1 month"
ExpiresByType application/ogg "now plus 1 month"
ExpiresByType audio/basic "now plus 1 month"
ExpiresByType audio/mid "now plus 1 month"
ExpiresByType audio/midi "now plus 1 month"
ExpiresByType audio/mpeg "now plus 1 month"
ExpiresByType audio/mp3 "now plus 1 month"
ExpiresByType audio/x-aiff "now plus 1 month"
ExpiresByType audio/x-mpegurl "now plus 1 month"
ExpiresByType audio/x-pn-realaudio "now plus 1 month"
ExpiresByType audio/x-wav "now plus 1 month"

## Movie files expiration: 1 month after request:

ExpiresByType application/x-shockwave-flash "now plus 1 month"
ExpiresByType x-world/x-vrml "now plus 1 month"
ExpiresByType video/x-msvideo "now plus 1 month"
ExpiresByType video/mpeg "now plus 1 month"
ExpiresByType video/mp4 "now plus 1 month"
ExpiresByType video/quicktime "now plus 1 month"
ExpiresByType video/x-la-asf "now plus 1 month"
ExpiresByType video/x-ms-asf "now plus 1 month"
ExpiresByType video/ogg "access plus 1 month"
ExpiresByType video/webm "access plus 1 month"

# Turn off the Last Modified header except for html docs:

<FilesMatch ".(ico|pdf|flv|jpg|jpeg|png|gif|js|css)$">
Header unset Last-Modified
</FilesMatch>

........................................................................................
........................................................................................
# Alternative stop for hotlinking:

<IfModule mod_rewrite.c>
RewriteRule \.(jpg|jpeg|png|png|xls|pdf|jpeg|jpg|gif|bmp|pdf|doc|xml|jpe?g|gif|tiff?)$ https://exempel.se/ [NC,R,L]
</IfModule>

.
#  ALT 2:  Some files only):

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_COOKIE} !.*wordpress_logged_in.*$ [NC]
RewriteCond %{REQUEST_URI} ^(.*?/?)wp-content/uploads/.*\.(?:gif|png|jpe?g|pdf|txt|rtf|html|htm|xlsx?|docx?|mp3|mp4|mov)$ [NC]
RewriteRule . http://%{HTTP_HOST}%1/wp-login.php?redirect_to=%{REQUEST_URI} [L,QSA]
</IfModule>

.
# ALT 3:Preventing Files Being Executed in Uploads Folder:
The relatively vulnerable wp-content/uploads folder could lead to the execution of some files like py, PHP, JSP and so on. 
It is vital to prevent such a malicious action with the line below:

<IfModule mod_rewrite.c>
RewriteRule ^wp-content/uploads/.*\.(php|pl|jsp|shtml|sh|inc|rb|py)$ - [F,L,NC]
</IfModule>

.
ALT 4:  Turn off everything: (uploads) / not recommended, but if you are under atack, a short while!

<Files ~ ".*..*">Order Allow,Deny Deny from all</Files>

.
ALT 5: Prevent hotlinking:

<IfModule mod_rewrite.c>RewriteRule \.(gif|jpg|js|css)$ - [F]</IfModule>

# Images Protect: If to mutch of people try to Download your images them: ( Use only temporarily, may stop some user agents) 

RewriteRule \.(png|xls|pdf|jpeg|jpg|gif|bmp|pdf|doc|xml|jpe?g|gif|tiff)$ /Oh no! Not again![L]


# ALT 6:
<IfModule mod_rewrite.c> RewriteRule ^upload/(.*)$ /wp-content/uploads/$1 [L]</IfModule>

........................................................................................
........................................................................................
# Prevent viewing of a specific fil:e

<files>secretfile.jpg="">order allow,deny Deny from all</files>

.....
# To hide all of png and jpg images:

IndexIgnore *.png *.jpg

# To hide single image:

IndexIgnore hidden_image.jpg

......
# Alternative Uploads folder:

<Files ~".*..*">Order Allow,Deny Deny from all</Files>

.....
# If you need hide a script: (Place it under rewrite cond:

RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule “(^|/)\.” – [F]

If:
RewriteRule .(sql|data|json|yml|ini) - [F]
RewriteRule ^wp-content/debug\.log$ - [F]
RewriteRule (^|/)error_log$ - [F]
RewriteRule (^|/)php_errorlog$ -  [F]

Noway:
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule !\.(css|js)$ index.php [L]
<IfModule mod_rewrite.c>


# BLOCK ALL OTHER SCRIPTS
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule \.(php.?|css|cgi)$ - [F,L]
</IfModule>

........................................................................................
........................................................................................
# If you got a shop/store:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_URI} !^/themes/stores/(.*)
RewriteCond %{REQUEST_URI} !^/themes/shop/(.*)
RewriteRule .? - [L]
</IfModule>

........................................................................................
........................................................................................
# IF you got .env:

<FilesMatch ".env">Order allow,deny Deny from all</FilesMatch>


#BLOCK BROWSER ACCESS TO LOG FILES
<Files  ~ ".log$">
Order allow,deny
Deny from all
</Files>

........................................................................................
........................................................................................
# Alternative CSS code protection:

RewriteRule \.(css)$ - [NC,F,L]

# Alternativs with CSS/JS:

RewriteRule \.(css|js)$ - [NC,F,L]

CSS:
<FilesMatch "\.(css|min.css)$">Require all denied</FilesMatch>


# ALT 1:

<IfModule mod_rewrite.c>
RewriteEngine On
rewritecond% {REQUEST_FILENAME}! ^ (. +).css $
rewritecond% {REQUEST_FILENAME}! ^ (. +).js $
rewritecond% {REQUEST_FILENAME}! file.php $
RewriteRule ^ (. +) $ / Deny / [nc]
</ifModule>

........................................................................................
........................................................................................
#  Notorius hacker - Send him to google!

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} ^https://example.com/
RewriteRule /* https://www.google.com [R,L]
</ifModule>

........................................................................................
........................................................................................
# Brute Force Login Protection:

<FilesMatch ".*\.(php|html?|css|js|jpe?g|png|gif)$">order deny,allow<FilesMatch""></FilesMatch>


# ALTERNATIVE:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} ^(/wp-login\.php|.*wp-login\.php.*)$
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{THE_REQUEST} HTTP/1\.0$ [OR]
RewriteCond %{SERVER_PROTOCOL} HTTP/1\.0$
RewriteRule ^(.*)$ - [F,L]</ifModule>

# ALTERNATIVE:  (do not forget:  IfModule mod_rewrite.c> and so on.

RewriteCond %{REQUEST_URI} ^(/wp-login\.php|/wp-comments-post\.php)$
RewriteCond %{THE_REQUEST} HTTP/1\.0
RewriteRule ^(.*)$ - [F,L]

# Deny on request method:

RewriteCond %{THE_REQUEST}!^(GET|POST)\ /.*\ HTTP/1\.(0|1)$ [NC]RewriteRule ^(.*) - [F]

# No Bruteforce:

RewriteCond %{REQUEST_URI} ^/user$
RewriteRule .* - [F]
RewriteCond %{QUERY_STRING} q=user
RewriteRule .* - [F]

........................................................................................
........................................................................................
# BACKDOOR NO WAY:

<FilesMatch “.+\.php$”/>Require all denied</Files>


# The 418 code is a humorous HTTP status code that means “I’m a teapot” and is not meant to be used seriously. #

RewriteCond %{HTTP_USER_AGENT} python-requests
RewriteRule ^.*$ teapot.php [L]

........................................................................................
........................................................................................
# BLOCK Folder, or private folder:

<IfModule mod_rewrite.c>
RewriteRule ^.*  - [R=404,L]
</IfModule>

# Alternative:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.*(folder name).* [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

........................................................................................
........................................................................................
# Simple File List Access Restricter:

# 1) If NOT the current host:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_HOST}@@%{HTTP_REFERER}!^([^@]*)@@https?://\1/.*
</ifModule>

# 2) Deny access to these types:
  
RewriteRule \.(gif|jpg|jpeg|png|tif|pdf|wav|wmv|wma|avi|mov|mp4|m4v|mp3|zip?)$ - [F]

........................................................................................
........................................................................................
# Denying access to specific file extensions
The following code forces any file ending in .inc to throw a 403 Forbidden error when visited:

<Files  ~ "\.inc$">  
Order Allow,Deny
Deny from All
</Files>

#  Alternartive:

<IfModule mod_rewrite.c>
RewriteEngine on RewriteRule ^folder/?$ - [F,L]
</ifModule>

........................................................................................
........................................................................................
# Optimize WP’s 404 Response: (may makes troublewith css)

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !^.*\.png [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.jpg [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.gif [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.css [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.xml [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.html [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]</IfModule>


# ALTERNATIVE:
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} !^.*\.png [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.jpg [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.gif [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.css [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.xml [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.php [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.html [NC]
RewriteRule . /index.php [L]
</IfModule>

####  ALternative:

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !^.*\.png [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.jp?g [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.gif [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.css [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.js [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.xml [NC]
RewriteCond %{REQUEST_FILENAME} !^.*\.html [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

........................................................................................
........................................................................................
# Look plugins to domain:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} /wp-content/plugins/ [NC]
RewriteCond %{HTTP_REFERER} !^https://exempel.se [NC]
RewriteRule .* - [F,L]
</IfModule>

........................................................................................
........................................................................................
# Block double extensions from being uploaded or accessed, including htshells:

<FilesMatch ".*\.([^.]+)\.([^.]+)$">
Order Deny,Allow
Deny from all
</FilesMatch>

# Alternative: Block double extensions from being uploaded or accessed

<FilesMatch ".*\.([^.]+)\.([a-zA-Z0-9]+)$">
Order Deny,Allow
Deny from all
</FilesMatch>

........................................................................................
........................................................................................
# REDIRECT to FEEDBURNER(if someone uses it):

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} ^/feed/ [NC]
RewriteCond %{HTTP_USER_AGENT} !(FeedBurner|FeedValidator) [NC]
RewriteRule .* http://feeds.feedburner.com/mainContentFeed [L,R=302]
RewriteCond %{REQUEST_URI} ^/comments/feed/ [NC]
RewriteCond %{HTTP_USER_AGENT} !(FeedBurner|FeedValidator) [NC]
RewriteRule .* http://feeds.feedburner.com/allCommentsFeed [L,R=302]
</IfModule>

........................................................................................
........................................................................................
# If the resource requested is a `wp-*` file or directory, poop to a 403. 

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} wp-.*$ [NC] 
RewriteCond %{ENV:REDIRECT_STATUS} ^$ 
RewriteCond %{REQUEST_FILENAME} -f [NC,OR] 
RewriteCond %{REQUEST_FILENAME} -d [NC] 
RewriteRule .* - [F,L] </IfModule>
 
........................................................................................
........................................................................................
# Denies any Direct request for files ending in .php with a 403 Forbidden. May break plugins/themes [403]/If you are under attack!

<IfModule mod_rewrite.c>
RewriteCond %{THE_REQUEST}^[A-Z]{3,9}\ /wp-includes/.*$ [NC]
RewriteCond %{THE_REQUEST}!^[A-Z]{3,9}\ /wp-includes/php/.+/.+\ HTTP/ [NC]
RewriteCond %{REQUEST_FILENAME} ^.+\.php$
RewriteRule .? - [F,NS,L]</IfModule>

........................................................................................
........................................................................................
From: https://perishablepress.com
			
<IfModule mod_rewrite.c>
RewriteCond%HTTP_REFERER example.com [NC,OR]
RewriteCond%HTTP_REFERER example.com/subpage [NC,OR]
RewriteRule .* - [F]</IfModule>

# ALTERNATIVE:

<IfModule mod_rewrite.c>
RewriteEngine on RewriteCond%{HTTP_REFERER}^$
RewriteRule ^ - [F,L]	
</ifModule>
		
........................................................................................
........................................................................................
# Block Russian Referrer Spam: //  Check your log what you got!

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http://.*example\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*example\.ru/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*example\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*example\.ru/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*semalt\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*semalt\.com/ [NC,OR]
RewriteRule ^(.*)$ – [F,L]</ifModule>

........................................................................................
........................................................................................
# CUSTOM rewrites - 301 redirects for pages moved to Idea Wrights:

<IfModule mod_rewrite.c>
RewriteRule ^oldpage/? https://example.com/new-page [R=301,L]
RewriteRule ^oldpage2/? https://example.com/new-page2 [R=301,L]
</ifModule>
	
........................................................................................
........................................................................................
# If you are under Tor Attack:  

# TOR-REDIRECT-BLOCK:

<IfModule mod_rewrite.c>
RewriteCond %{REMOTE_ADDR} ^103\.4\.16\.118$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.36\.183$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.36\.240$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.37\.158$ [OR]
RewriteCond %{REMOTE_ADDR} ^99\.230\.106\.155$ [OR]
RewriteCond %{REMOTE_ADDR} ^0\.0\.0\.0$
RewriteCond %{REQUEST_URI} !^/tor.php$
RewriteCond %{REQUEST_URI} !^/tor.css$
RewriteRule ^(.*)$ /tor.php [R,L]</ifModule>

Alternative:
<IfModule mod_rewrite.c>
RewriteCond %{REMOTE_ADDR} ^103\.4\.16\.118$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.36\.183$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.36\.240$ [OR]
RewriteCond %{REMOTE_ADDR} ^106\.187\.37\.158$ [OR]
RewriteCond %{REMOTE_ADDR} ^99\.230\.106\.155$ [OR]
RewriteCond %{REMOTE_ADDR} ^0\.0\.0\.0$
RewriteCond %{REQUEST_URI} !^/tor.php$
RewriteCond %{REQUEST_URI} !^/tor.css$
RewriteRule ^(.*)$ /tor.php [R,L]</ifModule>

........................................................................................
........................................................................................

# Block known bad URLs  + # Directories including sub-directories
Data can change to sentive file in admin:

RedirectMatch 404 "\/(wp-includes|wp-admin|wp-content|wordpress|wp|xxxss|cms|rss|feed|feeds|SQL|QXXLZ|data\/admin)"

........................................................................................
........................................................................................
# Blocking Pinterest by user agent in your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} Pinterest [NC]
RewriteRule !^robots\.txt$ - [F]</ifModule>

........................................................................................
........................................................................................
# IF you haven`t delated or need it for some reason:

<Files wlwmanifest.xml>Require all denied</Files>

........................................................................................
........................................................................................
# Ban suspicious URL query strings.
Another defense against RFI is to block all requests having the form:
GET /index.php?inc=http://badsite.com/badscript.txt?

# Set it to your own IP address so you are the only one who won't be blocked. use with care, if
under atack!

<IfModule mod_rewrite.c>
RewriteCond%{QUERY_STRING}^.*=(ht|f)tp\://.*$ [NC]
#RewriteCond%{REMOTE_ADDR}!^111\.222\.333\.444$ [NC]
RewriteRule .* - [F,L]</ifModule>

........................................................................................
........................................................................................
# Other query string bans:
Malicious RFI attempts almost always have a question mark at the end of the query string. Ban any query string that contains a question mark. 
 
 
RewriteCond%{QUERY_STRING}(\?|%3F) [NC]RewriteRule .* - [F,L]

# ALTERNATIVE:

RewriteCond %{QUERY_STRING}^(%2d|-)[^=]+$ [NC] RewriteRule ^(.*) $1? [L]

# ALTERNATIVE:

RewriteRule ^(.+)$ - [F]

# ALTERNATIVE:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond%{QUERY_STRING}(.*)(http|https|ftp)://(.*)
RewriteRule ^(.+)$ – [F,L]</ifModule>
........................................................................................
........................................................................................
# Secure WordPress Contact Forms:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} !^http://www.domain.com/.*$ [NC]
RewriteCond %{REQUEST_POST} .*contact.php$
RewriteRule .* - [F]</ifModule>

........................................................................................
........................................................................................
# From https://perishablepress.com: (if needed, put it in .htacess2)
 
<ifModule mod_rewrite.c>
 RedirectMatch 403 /\$\&
 RedirectMatch 403 (?i)/\&(t|title)=
 RedirectMatch 403 (?i)/\.(bash|git|hg|log|svn|swp|tar)
 RedirectMatch 403 (?i)/(1|contact|i|index1|iprober|phpinfo|phpspy|product|signup|t|test|timthumb|tz|visit|webshell|wp-signup).php
 RedirectMatch 403 (?i)/(author-panel|class|database|manage|phpMyAdmin|register|submit-articles|system|usage|webmaster)/?$
 RedirectMatch 403 (?i)/(=|_mm|cgi|cvs|dbscripts|jsp|rnd|shadow|userfiles)
</ifModule>

........................................................................................
........................................................................................
# ERROR LOGS:  deny access. 

<IfModule mod_rewrite.c>
RewriteRule (^|/)error_log$ - [F]
RewriteRule (^|/)php_errorlog$ - [F] 
RewriteRule ^wp-content/debug\.log$ - [F]
</ifModule>

# Deny Error Logs - Alternative:

RewriteRule (^|/)error_log$ - [F]
RewriteRule (^|/)php_errorlog$ - [F] 

........................................................................................
........................................................................................
# DENY Scanners:

<IfModule mod_rewrite.c>
RewriteCond%{HTTP_USER_AGENT}"^WPScan"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^sqlmap"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^sqlninja" [NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^Wappalyzer"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^zgrab"[NC]
RewriteCond%{HTTP_USER_AGENT}"^openvas"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^Nuclei" [NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^Nmap"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^Nikto"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^nessus"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^havij"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^dirbuster"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"^arachni"[NC,OR]
RewriteRule ^.* - [F,L]</IfModule>

# IF they print your page:

RewriteCond%{HTTP_REFERER} ^http://.*myprintscreen.com/ [NC,OR]

#IF Needed:
SetEnvIfNoCase User-Agent ^BackWeb bad_bot
SetEnvIfNoCase User-Agent ^Black bad_bot
SetEnvIfNoCase User-Agent ^Grab bad_bot
SetEnvIfNoCase User-Agent ^Info bad_bot
SetEnvIfNoCase User-Agent ^site bad_bot
SetEnvIfNoCase User-Agent ^Get bad_bot
SetEnvIfNoCase User-Agent ^Link bad_bot
SetEnvIfNoCase User-Agent ^Download bad_bot
SetEnvIfNoCase User-Agent ^Net bad_bot
SetEnvIfNoCase User-Agent ^Web bad_bot

........................................................................................
........................................................................................
# If you don't use the Database Optimizing and Post-by-Email features, turn off the access too:

<FilesMatch "(repair|wp-mail)\.php">
Order Deny,Allow
Deny from all
</FilesMatch>

........................................................................................
........................................................................................
# CGI SCRIPT: 
(Then, upload the .htaccess file to the directory in which you want to disable CGI script execution,)

# Remove: CGI:

Options AddHandler cgi-script .php .pl .py .jsp .asp .htm .html .txt .shtml .sh .cgi -ExecCGI

# PHP - (CSS/JS): 

Options AddHandler cgi-script .php .js .css .html .txt .readme .cgi -ExecCGI

#Alternative:
AddHandler cgi-script .php .txt .css .min.css .js .min.js .html .xml .json .cgi Options -ExecCGI
RemoveHandler .cgi .php .txt.php4 .php5 .phtml .pl .py .pyc .pyo .css .min.css .js .min.js .html .xml .json .htaccess 
........................................................................................
........................................................................................
# Deny Crawlers:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCon%{QUERY_STRING}(crawl|scanx|scan) [NC]
RewriteRule (.*) - [F,L]
</IfModule>


#ALTERNATIVE:

RewriteCond%{HTTP_USER_AGENT}"^WebCopier"[NC,OR]
RewriteRule ^.* - [F,L]

Maybe still someone uses:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (httrack) [NC]
RewriteRule (.*) - [F,L]
</IfModule>

Majestic:

SetEnvIfNoCase User-Agent "^(.*)mj12(.*)$" badbot=true
#SetEnvIf Remote_Addr ^192\. badbot=true
RewriteCond %{ENV:badbot} ^true$
RewriteRule ^.*$ - [R=500]
........................................................................................
........................................................................................
# DENY CHINA boots and crawlers:

RewriteCond %{HTTP_USER_AGENT} Mb2345Browser|LieBaoFast|zh-CN|MicroMessenger|zh_CN|Kinza|Datanyze|serpstatbot|OPPO\sA33|spaziodati [NC]
RewriteRule ^ - [F,L]


# DHuawei cloud IP range as follows (these are in CIDR format and will block the entire cloud data centre:

deny from 114.119.128.0/19
deny from 114.119.160.0/21
deny from 114.119.176.0/20

# DIPv6 addresses can be blocked via .htaccess similar to IPv4:

Deny from fe80::1ff:fe23:4567:890a
Deny from fe80::1ff:fe23:4567:890a/10
Deny from fe80::1ff:fe23:*:*
Deny from fe80::1ff:fe23

ALTERNATIVE:

SetEnvIfNoCase User-Agent (libwww-perl|wget|LieBaoFast|Mb2345Browser|zh-CN) bad_bot

ALTERNATIVE:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT (LieBaoFast|UCBrowser|MQQBrowser|Mb2345Browser) [NC]
RewriteRule .* - [F,L]</ifModule>


# If you do not want China spiders on your site: (change:baiduspider to what you do not want crawling.

RewriteCond %{HTTP_USER_AGENT} Baiduspider [NC]RewriteRule .* – [F,L]

# BAD BOT:

SetEnvIfNoCase User-Agent "Chrome version 0\.0 running on Win10 Mozilla\/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/78\.0\.3904\.97 Safari\/537\.36 OPR\/65\.0\.3467\.48" bad_bot
Deny from env=bad_bot

........................................................................................
........................................................................................
FROM: https://wpmudev.com/blog/hide-wordpress-login-page-2/

# BEGIN Hide login page:

<IfModule mod_rewrite.c>
RewriteRule ^mylogin$ https://%{SERVER_NAME}/wp-login.php?key=123&redirect_to=https://%{SERVER_NAME}/wp-admin/index.php [L]
RewriteCond %{HTTP_REFERER} !^https://%{SERVER_NAME}/wp-admin
RewriteCond %{HTTP_REFERER} !^https://%{SERVER_NAME}/wp-login.php
RewriteCond %{HTTP_REFERER} !^https://%{SERVER_NAME}/login
RewriteCond %{QUERY_STRING} !^key=123
RewriteCond %{QUERY_STRING} !^action=logout
RewriteCond %{QUERY_STRING} !^action=lostpassword
RewriteCond %{REQUEST_METHOD} !POST
RewriteRule ^(.*)$ - [F,L]</ifModule>


Be sure to change mylogin on line two to whatever you want your slug to be. If you don’t change it, 
you can find your login page at www.your-site.com/mylogin. If you do change it, your URL structure should be the same, except with your slug in place of mylogin.

It’s recommended that you change the slug since this post is available to the public which means 
hackers have access to it as well. If you do use it, they won’t have to guess your login URL since it’s printed here.

Also be sure to change 123 in lines two and seven to something else. This is a secret key that isn’t displayed to hackers. 
You should pick something that isn’t obvious so don’t change the secret key to “wordpress” or the title of your site. Your key should also only have letters and numbers.

........................................................................................
........................................................................................
# ADMIN sensitive files Admin: (add it your .htacces in admin folder:

RewriteRule ^wp-admin/(install|setup-config|upgrade)\.php - [L,R=404]
RewriteRule ^wp-admin/maint/repair\.php - [L,R=404]

........................................................................................
........................................................................................
# Bad as hell bots and hackers/scanners:

#COMMENT | This blocks visitors with no identification
#COMMENT | Trust me you want this, as only a human hacker uses this particular rule versus a bot
SetEnvIfNoCase User-Agent ^$ bad_bot

#COMMENT | This blocks a notorious hacking trick, very dangerous.
#COMMENT | Trust me you want this, as only a human hacker uses this particular rule versus a bot
SetEnvIfNoCase User-Agent ^Mozilla/5.0$ bad_bot
SetEnvIfNoCase User-Agent ^-$ bad_bot

#COMMENT | This blocks a notorious hacking trick, very dangerous.
#COMMENT | Trust me you want this, as only a human hacker uses this particular rule versus a bot
SetEnvIfNoCase User-Agent ^Mozilla$ bad_bot

#COMMENT | This blocks very old and dangerous browsers
SetEnvIfNoCase User-Agent .*ozilla/1.* bad_bot
SetEnvIfNoCase User-Agent .*ozilla/2.* bad_bot
SetEnvIfNoCase User-Agent .*ozilla/3.* bad_bot
SetEnvIfNoCase User-Agent .*ozilla/4.* bad_bot

#COMMENT | This blocks Baidu    (Kina Crawler)
SetEnvIfNoCase User-Agent .*ai.* bad_bot

#COMMENT | This blocks Yandex   (Russia Crawler)
SetEnvIfNoCase User-Agent .*ande.* bad_bot

#COMMENT | This blocks most Scanners
SetEnvIfNoCase User-Agent .*can.* bad_bot

OR try:  SetEnvIfNoCase User-Agent .*scan.* bad_bot

#COMMENT | This blocks most cgi hackers. delete if you use cgi
SetEnvIfNoCase User-Agent cg.* bad_bot
SetEnvIfNoCase User-Agent .*cg.* bad_bot

#COMMENT | This blocks hackers looking for config.php
SetEnvIfNoCase User-Agent conf.* bad_bot
SetEnvIfNoCase User-Agent .*conf.* bad_bot

#COMMENT | This blocks hackers some script bots
SetEnvIfNoCase User-Agent .*crip.* bad_bot

#COMMENT | This blocks curl code hackers.
#COMMENT | IMPORTANT delete it if you are using a ecommerce payment gateway with your site
SetEnvIfNoCase User-Agent cur.* bad_bot
SetEnvIfNoCase User-Agent .*cur.* bad_bot

#COMMENT | This blocks .exe code injection attempts
SetEnvIfNoCase User-Agent ex.* bad_bot
SetEnvIfNoCase User-Agent .*ex.* bad_bot

#COMMENT | This blocks some blackhat hackers
SetEnvIfNoCase User-Agent .*hat.* bad_bot
SetEnvIfNoCase User-Agent .*hat bad_bot

#COMMENT | This blocks Indybot a notorious bandwidth hog   (INDIA)
SetEnvIfNoCase User-Agent indybot bad_bot
SetEnvIfNoCase User-Agent indy.* bad_bot
SetEnvIfNoCase User-Agent .*indy.* bad_bot

#COMMENT | This blocks remote javascript code injection attempts
SetEnvIfNoCase User-Agent jav.* bad_bot
SetEnvIfNoCase User-Agent .*jav.* bad_bot

#COMMENT | This blocks hackers and bots looking for your logs
SetEnvIfNoCase User-Agent log bad_bot
SetEnvIfNoCase User-Agent log.* bad_bot
SetEnvIfNoCase User-Agent .*log.* bad_bot
SetEnvIfNoCase User-Agent .*log bad_bot

#COMMENT | This blocks Morfeus which attempts to exploit your SOAP file #COMMENT | This is extremely dangerous
SetEnvIfNoCase User-Agent .*orfeu.* bad_bot

#COMMENT | This blocks remote php file exploits
SetEnvIfNoCase User-Agent .*php.* bad_bot
SetEnvIfNoCase User-Agent .*php bad_bot
	
#COMMENT | This blocks some portscanners
SetEnvIfNoCase User-Agent port bad_bot
SetEnvIfNoCase User-Agent port.* bad_bot
SetEnvIfNoCase User-Agent .*port.* bad_bot
SetEnvIfNoCase User-Agent .*port bad_bot
	
#COMMENT | This blocks query and hotel.qunar exploits
SetEnvIfNoCase User-Agent .*qu.* bad_bot
SetEnvIfNoCase User-Agent qu.* bad_bot

#COMMENT | This blocks some proxys IMPORTANT delete this if you have visitors from Africa since many connections are made with Africa/Proxy
SetEnvIfNoCase User-Agent .*rox.* bad_bot

#COMMENT | This blocks a URL scraper code
SetEnvIfNoCase User-Agent .*url.* bad_bot

#COMMENT | This blocks mysql or sql exploits
SetEnvIfNoCase User-Agent sq.* bad_bot
SetEnvIfNoCase User-Agent .*sq.* bad_bot

#COMMENT | This blocks pythonrequests
SetEnvIfNoCase User-Agent .*yth.* bad_bot

#COMMENT | This blocks zeus (a dangerous hack code)
SetEnvIfNoCase User-Agent zeu.* bad_bot
SetEnvIfNoCase User-Agent .*zeu.* bad_bot

#COMMENT | This blocks ZmEu (a dangerous hack code)
SetEnvIfNoCase User-Agent zme.* bad_bot
SetEnvIfNoCase User-Agent .*zme.* bad_bot

#COMMENT | This blocks zgrab (a dangerous hack code)
SetEnvIfNoCase User-Agent zgra.* bad_bot
SetEnvIfNoCase User-Agent .*zgra.* bad_bot

.......

# Vulnerability Scanners:

SetEnvIfNoCase User-Agent "Acunetix" bad_bot
SetEnvIfNoCase User-Agent "FHscan" bad_bot
SetEnvIfNoCase User-Agent "^LinkScan/8.1a.Unix" bad_bot

OR:  (maybe stops google? try and se)
SetEnvIfNoCase User-Agent .*scan.* bad_bot

OR TRY: SetEnvIfNoCase User-Agent .*can.* bad_bot 

Bad bots:
SetEnvIfNoCase User-Agent ([a-z0-9]{2000,}) bad_bot

Headless Chrome scan:  (maybe stops google?)
RewriteCond %{HTTP_USER_AGENT} Head RewriteRule .* - [F]

OR: SetEnvIfNoCase User-Agent HeadlessChrome bad_bot

#UniversalRules:
SetEnvIfNoCase User-Agent ^$ bad_bot
SetEnvIfNoCase User-Agent .*\@.* bad_bot
SetEnvIfNoCase User-Agent .*bot.* bad_bot

Crawlers:
SetEnvIfNoCase User-Agent "PHPCrawl" bad_bots

Others:
SetEnvIfNoCase User-Agent "site_checker" bad_bots
SetEnvIfNoCase User-Agent "X-Scan" bad_bots

Plugin Errors:
SetEnvIfNoCase User-Agent "plugin_error_Scan" bad_bots

### STOP Zombie bots:
SetEnvIfNoCase User-Agent "Zombi" bad_bots
........................................................................................
........................................................................................
# Stop WPSCAN: 
# Detect that someone is accessing those strange files

<IfModule mod_rewrite.c>
RewriteRule ^wp-config\.php\.save$ index.php?wp_config_enumeration=1 [L]
RewriteRule ^\.wp-config\.php\.swp$ index.php?wp_config_enumeration=1 [L]
RewriteRule ^wp-config\.php\.swp$ index.php?wp_config_enumeration=1 [L]
RewriteRule ^(.*)wp-content/plugins/(.*)$ index.php?plugin_enumeration=1 [L]
RewriteRule ^readme\.html$ - [R=404,L,NC]
RewriteRule ^readme\.txt$ - [R=404,L,NC]
RewriteRule ^changelog\.txt$ - [R=404,L,NC]
RewriteRule ^wp-includes/rss\.php$ - [R=404,L,NC]               
RewriteRule ^(.*)wp-content/plugins/(.*)/readme\.txt$ - [R=404,L]
RewriteRule ^(.*)wp-content/plugins/(.*)$ index.php?plugin_enumeration=1 [L]
RewriteRule ^wp-config\.php\.save$ index.php?wp_config_enumeration=1 [L]
RewriteRule ^\.wp-config\.php\.swp$ index.php?wp_config_enumeration=1 [L]
RewriteRule ^wp-config\.php\.swp$ index.php?wp_config_enumeration=1 [L]
</IfModule>

........................................................................................
........................................................................................
# IF they tries to connect;

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond%{REQUEST_METHOD} ^CONNECT
RewriteRule .* - [R=405,L]</ifModule>

........................................................................................
........................................................................................
# Disable Internet Explorer Compatibility View

<IfModule mod_headers.c>
BrowserMatch MSIE is-msie
Header set X-UA-Compatible IE=edge env=is-msie
</IfModule>

........................................................................................
........................................................................................
DENY google proxy;

RewriteCond %{HTTP_REFERER} google-proxy-00-000-000-00.google.com\.com

ADD IP: 000 and so on.

........................................................................................
........................................................................................
# BLOCK COUNTRY:

SetEnvIf CF-IPCountry "country" BuzzOff=1
Order allow,deny
Allow from all
Deny from env=BuzzOff

: 
# Redirect one country

RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^CA$
RewriteRule ^(.*)$ http://www.canada.com$1 [L]

:
FUNKAR INTE ALLTID:
# Redirect multiple countries to a single page

RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^(CA|US|MX)$
RewriteRule ^(.*)$ http://www.northamerica.com$1 [L]

:
FUNKAR INTE ALLTID:
RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^(CN|KR|CN|MY|JP|KP|KR)$
RewriteRule ^(.*)$ asia.example.com$1 [R,L]

:
SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry
Deny from env=BlockCountry

:
RewriteCond %{HTTP:CP-IPCountry} !^(DE|NL|)$
RewriteRule .* - [F,L]

# Block whole country, not always blocking all spammers!
 
Blocking a certain country, e.g. China (CN).

SetEnvIf MM_COUNTRY_CODE ^(CN) BlockedCountry
Deny from env=BlockedCountry

* Redirecting users from a certain country (Finland) to another domain:
# Send the stupid country somewhere else.....

SetEnvIf MM_COUNTRY_CODE ^(FI) FINLAND
RewriteCond% {ENV:FINLAND} ^1$
RewriteRule .* http://www.example.fi%{REQUEST_URI} [R=301,L]


# Allowing access only from countries of the European Union:

SetEnvIf MM_COUNTRY_CODE ^(AT|BE|BG|CZ|CY|DE|DK|EE|EL|ES|FI|FR|HR|HU|IE|IT|LT|LU|LV|MT|NL|PL|PT|RO|SE|SI|SK) EUROPEANUNION
order deny,allow
deny from all
allow from env=EUROPEANUNION

# KINA
SetEnvIf MM_COUNTRY_CODE ^(CN) BlockedCountry
Deny from env=BlockedCountry

###
# Redirect Geo Conflict Hotspots by Remote Host to The 404 #

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} !my 404 adress.php/
RewriteCond %{REMOTE_HOST} \.ru$ [NC,OR] #Russia 
RewriteCond %{REMOTE_HOST} \.am$ [NC,OR] #Armenia
RewriteCond %{REMOTE_HOST} \.by$ [NC,OR] #Belarus 
RewriteCond %{REMOTE_HOST} \.kz$ [NC,OR] #Kazakhstan
RewriteCond %{REMOTE_HOST} \.kg$ [NC,OR] #Kyrgyzstan
RewriteCond %{REMOTE_HOST} \.tj$ [NC,OR] #Tajikistan
RewriteCond %{REMOTE_HOST} \.ve$ [NC,OR] #Venezuela
RewriteCond %{REMOTE_HOST} \.kp$ [NC,OR] #North Korea
RewriteCond %{REMOTE_HOST} \.ir$ [NC,OR] #Iran 
RewriteCond %{REMOTE_HOST} \.sy$ [NC,OR] #Syria
RewriteCond %{REMOTE_HOST} \.ye$ [NC] #Yemen
RewriteRule ^(.*)$ /my 404 adress.php/ [NC,L]</ifModule> 

#Alternative:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} ^https://.*amazonaws\.com [OR]
RewriteCond %{REMOTE_HOST} ^.*\.compute-1\.amazonaws\.com$ [NC,OR]  
RewriteRule ^(.*)$ – [F,L]</IfModule>

#Alternative:

RewriteCond %{HTTP_HOST} !^example\.com [NC]
RewriteCond %{HTTP_HOST} !^$
RewriteRule ^/?(.*) https://example.com/$1 [L,R,NE]

#Alternative:
RewriteCond %{HTTP_HOST} ^example.de [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.net$ [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.de$ [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.org$ [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.info$ [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.at$ [OR]
RewriteCond %{HTTP_HOST} ([^.]+)\.example\.ch$
RewriteRule (.*) https://example.com/$1 [R=301,L]

THIS WORKS GREAT for me, use it my content folder:  Tired of Kina and Hongkong...

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} \.hk$ [NC] #Hongkong
RewriteCond %{HTTP:From} \.hk$ [NC,OR] #Hongkong
RewriteRule ^.* - [F,L]
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} \.CN$ [NC] #Kina
RewriteCond %{HTTP:From} \.CN$ [NC,OR] #KINA
RewriteRule ^.* - [F,L]
</IfModule>

# Example:  

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} \.XX$ [NC] #Country
RewriteCond %{HTTP:From} \.XX$ [NC,OR] #Country
RewriteRule ^.* - [F,L]
</IfModule>

#Alternative:
RewriteCond %{HTTP_REFERER} (.cc) [NC,OR]

RewriteCond %{HTTP_REFERER} (.ru) [NC,OR]

#Alternative:  (hongkong)
<limit GET>deny from HK, HKG, HKD</limit>


## Alternative # works well, I use it to get rid of scumbags:

<IfModule mod_rewrite.c>RewriteCon %{HTTP_REFERER}^https?://[^/]+\.countryodehere/?[NC]RewriteRule ^.* - [F,L]</IfModule>

"" ANOTHER WAY:  if tries: public_html/uploads:

<IfModule mod_rewrite.c>
RewriteCond%{ENV:GEOIP_COUNTRY_CODE}!^(HK|CH|IN)$
RewriteRule (wp-uploads|public_html).php$ - [F,L]
</IfModule>
........................................................................................
........................................................................................
# Redirect wp-login.php
Leaving the login page at its default setting is a security risk. 
By changing this, you make it a bit more difficult for uninvited guests to gain entrance to your WP-admin.

# REDIRECT /WP-LOGIN.PHP TO /ACCESS

RewriteRule ^access$ /wp-login.php [NC,L]

From: https://borishoekmeijer.nl/

........................................................................................
........................................................................................
# Refuse requests to these files: .js or whatever!

<FilesMatch "(file_1\.js|file_2\.js)">
Order Allow,Deny
Deny from all
</FilesMatch>

........................................................................................
........................................................................................
# Below They will see any file that is .php as .g file.
#let them see php as g  - from:Disguise Script Extensions (https://perishablepress.com)

RewriteRule ^(.*)\.g$ $1.php

# serve foo files as php files:

AddType application/x-httpd-php .foo

# serve foo files as cgi files:

AddType application/x-httpd-cgi .foo

........................................................................................
........................................................................................
# I case you don't want any extension to show ,
To make http://codingsavvy.com/home.php as http://codingsavvy.com/home

RewriteRule ^([^/.]+)/?$ $1.php

........................................................................................
........................................................................................
# Protect core:

RedirectMatch 403 "/core/(.*).php
RedirectMatch 403 "/core/(.*).txt"

........................................................................................
........................................................................................
#Don't allow screenshots:

RewriteCond %{REQUEST_URI} screenshot(?:\-\d+)?\.(?:jpe?g|png|gif)$ [NC,OR]

........................................................................................
........................................................................................
#Alternative:(xml/json)

<FilesMatch "\.(?i:xml|json)$"><IfModule !mod_authz_core.c>Order allow,denyAllow from all</IfModule><IfModule mod_authz_core.c>Require all denied</IfModule></FilesMatch>

# deny *everything* - only if you are under atack!

<FilesMatch ".*..*"><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule !mod_authz_core.c>Order Allow,Deny Deny from all</IfModule></FilesMatch>

........................................................................................
........................................................................................
# Allow documents: pdf, doc, docx, xls, xslx, pps, ppsx, ppt, pptx, psd, odt, key:
   
<FilesMatch "\.(?i:pdf|docx?|xlsx?|pp[st]x?|psd|odt|key)$">
<IfModule !mod_authz_core.c>
Order allow,deny
Allow from all
</IfModule>
<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</FilesMatch>
 
# Allow audio video:  mp2, mp3, mp4, mpg, m4a, m4v, ogg, ogv, wav, mov, wma, wmv, avi, 3gp, 3g2 :
  
<FilesMatch "\.(?i:mp[2-5g]|m4[av]|og[gv]|wav|mov|wm[av]|avi|3g[p2])$">
<IfModule !mod_authz_core.c>
Order allow,deny
Allow from all
</IfModule>
<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</FilesMatch>

........................................................................................
........................................................................................
# No User agent . no robots.txt!

RewriteCond "%{ENV:noagent}" "=1"RewriteCond %{REQUEST_URI}!^/robots\.txt$RewriteRule ^.*$ - [R=451,L]
	
........................................................................................
........................................................................................
# PHP CGI-bin protect:

RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]RewriteRule ^(.*) $1? [L]

........................................................................................
........................................................................................
# BLOCK 404 MOBILE REQUESTS

<ifmodule mod_rewrite.c>
RewriteCond %{REQUEST_URI} /iphone/?$ [NC,OR]
RewriteCond %{REQUEST_URI} /android/?$ [NC,OR]
RewriteCond %{REQUEST_URI} /mobile/?$ [NC,OR]
RewriteCond %{REQUEST_URI} /mobi/?$ [NC,OR]
RewriteCond %{REQUEST_URI} /m/?$ [NC]
RewriteRule (.*) - [F,L]
</ifmodule>

From:https://perishablepress.com

# Alternative:

RewriteCond %{REQUEST_URI} ^/iphone/?$ [NC,OR]
RewriteCond %{REQUEST_URI} /android/?$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/mobile/?$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/mobi/?$ [NC,OR]
RewriteCond %{REQUEST_URI} ^/m/?$ [NC]

........................................................................................
........................................................................................
# Very good if: 

<IfModule mod_alias.c>
RedirectMatch 403 file\.php
RedirectMatch 403 view\.php
RedirectMatch 403 view\.css
RedirectMatch 403 view\.js
RedirectMatch 403 view\.json
RedirectMatch 403 view\.xml
RedirectMatch 403 view\core
RedirectMatch 403 errors\.
RedirectMatch 403 errors\.php
RedirectMatch 403 display\.
RedirectMatch 403 display\.php
RedirectMatch 403 include\.
RedirectMatch 403 include\.php
RedirectMatch 403 register\.
RedirectMatch 403 register\.php
RedirectMatch 403 wp/content/plugins\.php
RedirectMatch 403 \/wp\-signup\.php
RedirectMatch 403 \/includes\/
RedirectMatch 403 \/path\_to\_script\/
Redirectmatch 403 remoteFile
RedirectMatch 403 (?i)([a-z0-9]{2000,})
RedirectMatch 403 (?i)(https?|ftp|php):/
</IfModule>

<IfModule mod_alias.c>
RedirectMatch 403 \,
RedirectMatch 403 \:
RedirectMatch 403 \;
RedirectMatch 403 \=
RedirectMatch 403 \@
RedirectMatch 403 \[
RedirectMatch 403 \]
RedirectMatch 403 \^
RedirectMatch 403 \
RedirectMatch 403 \{
RedirectMatch 403 \}
RedirectMatch 403 \~
RedirectMatch 403 \”
RedirectMatch 403 \$
RedirectMatch 403 \<
RedirectMatch 403 \>
RedirectMatch 403 \|
RedirectMatch 403 \.\.
RedirectMatch 403 \%0
RedirectMatch 403 \%A
RedirectMatch 403 \%B
RedirectMatch 403 \%C
RedirectMatch 403 \%D
RedirectMatch 403 \%E
RedirectMatch 403 \%F
RedirectMatch 403 \%22
RedirectMatch 403 \%27
RedirectMatch 403 \%28
RedirectMatch 403 \%29
RedirectMatch 403 \%3C
RedirectMatch 403 \%3E
RedirectMatch 403 \%3F
RedirectMatch 403 \%5B
RedirectMatch 403 \%5C
RedirectMatch 403 \%5D
RedirectMatch 403 \%7B
RedirectMatch 403 \%7C
RedirectMatch 403 \%7D

# COMMON PATTERNS
Redirectmatch 403 \_vpi
RedirectMatch 403 \.inc
Redirectmatch 403 xAou6
Redirectmatch 403 db\_name
Redirectmatch 403 select\(
Redirectmatch 403 convert\(
Redirectmatch 403 \/query\/
RedirectMatch 403 ImpEvData
Redirectmatch 403 \.XMLHTTP
Redirectmatch 403 proxydeny
RedirectMatch 403 function\.
Redirectmatch 403 remoteFile
Redirectmatch 403 servername
Redirectmatch 403 \&rptmode\=
Redirectmatch 403 sys\_cpanel
RedirectMatch 403 db\_connect
RedirectMatch 403 doeditconfig
RedirectMatch 403 check\_proxy
Redirectmatch 403 system\_user
Redirectmatch 403 \/\(null\)\/
Redirectmatch 403 clientrequest
Redirectmatch 403 option\_value
RedirectMatch 403 ref\.outcontrol

# SPECIFIC EXPLOITS
RedirectMatch 403 errors\.
RedirectMatch 403 config\.
RedirectMatch 403 include\.
RedirectMatch 403 display\.
RedirectMatch 403 register\.
Redirectmatch 403 password\.
RedirectMatch 403 maincore\.
RedirectMatch 403 authorize\.
Redirectmatch 403 macromates\.
RedirectMatch 403 head\_auth\.
RedirectMatch 403 submit\_links\.
RedirectMatch 403 change\_action\.
Redirectmatch 403 com\_facileforms\/
RedirectMatch 403 admin\_db\_utilities\.
Redirectmatch 403 Table\/Latest\/index\.
</IfModule>

If needed:
RedirectMatch 403 (?i)/+.cache/
RedirectMatch 403 (?i)/+upload

***Copy what you need ans add it to your .htaccess1*
........................................................................................
........................................................................................
# Removing File Extensions:  Cannot works in some cases!

<IfModule mod_rewrite.c>
RewriteRule ^([^/]+)/([^/]+)/$ /$1/$2.html
RewriteCond %{REQUEST_URI} !(\.[a-zA-Z0-9]{1,5}|/)$
RewriteRule (.*)$ /$1/ [R=301,L]
</IfModule>

........................................................................................
........................................................................................
# Block File Reading: (themes/plugins:

<FilesMatch "\.(po|mo|css|js|phps|xlsx|pdf|txt|xml|zip)$">Order Allow,Deny Deny from all</FilesMatch>

Apache 2,4+
<FilesMatch "\.(po|mo|css|js|phps|xlsx|pdf|txt|xml|zip)$">Require all denied</FilesMatch>

........................................................................................
........................................................................................
# Then change the redirect location, /custom.php, to whatever is required.  ####

RewriteRule .* /custom.php [R=301,L]

From: https://perishablepress.com

..............................................
# Redirecting 404 requests for favicon files:
 
<IfModule mod_alias.c>RedirectMatch 403 favicon.ico</IfModule>

From: https://perishablepress.com
........................................................................................
........................................................................................
# Rules:
redirect all attempts to access files with names starting with, "phpMyAdmin" to index.php!

RewriteRule ^/phpMyAdmin.*$ /index.php

#  ATERNATIVE:
RewriteRule ^/php.*$ /index.php

# ATERNATIVE:
RewriteCond %{REQUEST_URI} \.php$ RewriteRule ^(.*)$ - [F,L]

# ATERNATIVE:
RedirectMatch 404 \.php$
........................................................................................
........................................................................................
# Block bruteforcing through xml-rpc - Alternative metod:

RewriteRule ^xmlrpc.php$ "http://0.0.0.0/" [R=301,L]

........................................................................................
........................................................................................
# Protect: contact files:

RewriteCond%{HTTP_REFERER}!^https://www.%{HTTP_HOST}/.*$[NC]RewriteCond%{REQUEST_POST}.*contact.php$ RewriteRule.*-[F]
........................................................................................
........................................................................................
# The following lines added to your 
.htacces file will block any requests coming from IP addresses starting 
with XXX.23 or XX.1 where the User Agent starts with Java:

# anonymous Java-based spiders

<IfModule mod_rewrite.c>
RewriteCond %{REMOTE_HOST} ^XXX\.23[0-9] [OR]
RewriteCond %{REMOTE_HOST} ^XX\.1[0-9][0-9]
RewriteCond %{HTTP_USER_AGENT} ^Java
RewriteRule .* - [F]
</IfModule>

........................................................................................
........................................................................................
# Stop Requests for humans.txt:

<IfModule mod_rewrite.c>RewriteCond %{QUERY_STRING} http\:\/\/www\.google\.com\/humans\.txt\? [NC]RewriteRule .* - [F,L]</IfModule>

IF. txt, readme/licence still on the wordpress:

<Files license.txt><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>
<Files readme.html|readme.txt><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

........................................................................................
........................................................................................
# Another way to protect admin. But you need static IP Adress! who never changes!

<IfModule mod_rewrite.c>
RewriteEngine on 
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR] 
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$ 
RewriteCond %{REMOTE_ADDR} !^123.123.123.123$ RewriteRule ^(.*)$ – [R=403,L]
</ifModule>

# Another way to protect wp-login:

<Files wp-login.php>
order deny,allow
Deny from all
allow from 123.123.123.123
</Files>

# Alternative:

<FilesMatch ".*">
Order Deny,Allow
Deny from all
Allow from 123.123.123.123
</FilesMatch>


# If you have multiple IP addresses (such as if you have multiple people logging into wp-admin), 
you can want to use this:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123.123.123.121$
RewriteCond %{REMOTE_ADDR} !^123.123.123.122$
RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
RewriteRule ^(.*)$ - [R=403,L]
</ifModule>

........................................................................................
........................................................................................
# Maybe in htaccess1 if needed:

<Files *.php><IfModule mod_authz_core.c>Require all denied</IfModule></Files>
<Files *.js><IfModule mod_authz_core.c>Require all denied</IfModule></Files>
<Files *.css><IfModule mod_authz_core.c>Require all denied</IfModule></Files>
<Files *.json><IfModule mod_authz_core.c>Require all denied</IfModule></Files>

# Debug: (if it visble on server)

<Files debug.log><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

# Readme/Licence:

<Files license.txt><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>
<Files readme.html|readme.txt><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

# Config.php: (if you do not use my .htaccess firewalls:

<Files wp-config.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

# wp-cron:

<Files wp-cron.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

# wp-links-oplm.php:

<Files wp-links-opml.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>

# xmlrpc fie: (if you do not use my firewall):

<Files xmlrpc.php><IfModule mod_authz_core.c>Require all denied</IfModule><IfModule!mod_authz_core.c>Order deny,allow Deny from all</IfModule></Files>
........................................................................................
........................................................................................
# Useful in wp-config.php:

# IF needed avoid https requests:  If you are under attack! (Use only temporarily, may stop upgrading checking) 
In wp-config php file:
define('DISABLE_WP_CRON',true);

# CRON: Time out:
define(‘WP_CRON_LOCK_TIMEOUT’,480);

# Other usefuls:
define('WP_DISABLE_FATAL_ERROR_HANDLER',true);   

# Memory:
define('WP_MAX_MEMORY_LIMIT','128M'); (or: 512M)

Cache:
define('WP_CACHE',true);

# Enable automatic WordPress updates:
define(‘WP_AUTO_UPDATE_CORE’,true);
define('WP_AUTO_UPDATE_CORE',‘minor’);

# Disable all automatic updates
define( 'AUTOMATIC_UPDATER_DISABLED', true );

# Disable automatic updates for core
define( 'WP_AUTO_UPDATE_CORE', false );

# Disable automatic updates for themes
add_filter( 'auto_update_theme', '__return_false' );

# Disable automatic updates for plugins
add_filter( 'auto_update_plugin', '__return_false' );

# If no update:
define('AUTOMATIC_UPDATER_DISABLED',true);

# To limit the number of revisions, just replace the false value with any integer number. 
For instance, the following line limits the revisions to just 12.
define('WP_POST_REVISIONS',12);

- OR:
Disable WP_POST_REVISIONS::
define( 'WP_POST_REVISIONS', false );:

# Changing the Autosave Interval:
define( 'AUTOSAVE_INTERVAL', 120 ); // Seconds
Trash:
define('EMPTY_TRASH_DAYS',3);   

# By default, WP_CACHE is not defined, // Enable caching in WordPress
define( 'WP_CACHE', true ); 

# # Orher usefull:

define('WP_DEBUG_DISPLAY',false);

define('CONCATENATE_SCRIPTS',false);

#Block External URL Requests: Can stop if you got auto things and google, try it and se.

define('WP_HTTP_BLOCK_EXTERNAL',true);

#Whitelisted Domain:

define('WP_ACCESSIBLE_HOSTS','test.com');

Do not see my errors:
define('WP_DEBUG_DISPLAY',false);

#OR (php)(php.ini):

ini_set('display_errors','off');
error_reporting(E_ALL|E_STRICT);

After settings.php: (if no errors reporting): (php.ini)

@error_reporting(E_NOTICE ^ E_DEPRECATED);

#OR:
define('display_errors','off');

#Set to 'false' to disable secure session cookies and to allow log-in without HTTPS.
define("SECURE_COOKIES",true);
	
#Enable GZIP compression for responses
define('ENABLE_RESPONSE_COMPRESSION',true);


#Enforce the Use of ‘FTP’:
define(‘FS_METHOD’, ‘ft

#Method to ensure that the plugins are being installed by a valid user is to force users to provide ‘FTP’ details:
define(‘FS_METHOD’, ‘ftpext’);

#If your web host or server supports ‘FTPS’ then add the following lines in the config file:
define(‘FTP_SSL’, true);

#If your web host or server supports ‘SFTP’ then add the following lines:

define(‘FS_METHOD’, ‘ssh2’);

# I Controlling Script Concatenation and Minification:
define( 'CONCATENATE_SCRIPTS', true );
define('COMPRESS_SCRIPTS', true); 
define('COMPRESS_CSS', true); 
define('ENFORCE_GZIP', true);      //forces gzip for compression instead of deflate

# Repairing and Optimizing The Database:  Once the process is complete, 
you should remove the WP_ALLOW_REPAIR line from your wp-config.php file to prevent anyone else from accessing the feature.
define( 'WP_ALLOW_REPAIR', true );

# Handling memory limitations:
define( 'WP_MAX_MEMORY_LIMIT', '256M' );
-OR:
define( 'WP_MAX_MEMORY_LIMIT', '512M' );
........................................................................................
........................................................................................
#Admin protect>

RewriteRule ^wp-admin/(install|setup-config|upgrade)\.php - [L,R=404]
RewriteRule ^wp-admin/maint/repair\.php - [L,R=404]

........................................................................................
........................................................................................
#DENY: VPN:  Test it and see?

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{ENV:IP2PROXY_PROXY_TYPE} ^(VPN|WEB)$
RewriteRule ^(.*)$ - [F]
</ifModule>

........................................................................................
........................................................................................
#No download please:
Change: sites to folder/ wp-content/uploads

RewriteRule ^sites\/default\/files\/(protected_download_dir\/.*)$ index.php?q=system/files/$1 [L,QSA]

#  Alternative:
<IfModule mod_alias.c>
RedirectMatch 403 ^/wp-content/uploads/
</IfModule>

# Prevent Downloading
Sometimes you want to force the browser to display some content instead of downloading it.
Change: myfile here to what it is: Pdf or whatever.

........................................................................................
........................................................................................
# DIV:
<Files tent should always be UTF-8 encoded, no?  Note: Not always working, but try andse!

# Use UTF-8 encoding for anything served text/plain or text/html
AddDefaultCharset utf-8

# Force UTF-8 for a number of file formats
AddCharset utf-8 .atom .css .js .json .rss .vtt .xml

Feed UTF-8:
<IfModule mod_mime.c>AddCharset utf-8 .atom \ .feed \ .rdf \ .rss \.xml</IfModule>

# Auto UTF-8 Encode:
Your text content should always be UTF-8 encoded, no?  Note: Not always working, but try andse!

# Use UTF-8 encoding for anything served text/plain or text/html
AddDefaultCharset utf-8

# Force UTF-8 for a number of file formats:
AddCharset utf-8 .atom .css .js .json .rss .vtt .xml

........................................................................................
........................................................................................
# Extra Security:  Try which works!

RewriteRule ^/wp-includes/ - [L,R=403]
RewriteRule ^cache/ - [L,R=403]
RewriteRule ^uploads/ - [L,R=403]
RewriteRule ^(?:cache|log)\b.* - [R=403,L]
RewriteRule ^(?:errors)\b.* - [R=403,L]

Just find above on: .htaccess1  and change it to:

# OR Maybe:

RewriteRule ^^/wp-content/themes/ -  [F]
RewriteRule ^/wp-content/plugins/ -  [F]
RewriteRule ^/wp-content/ -  [F]
RewriteRule ^uploads/ -  [F]

# Can also works with:

RewriteRule ^/forbid/(.*)$ - [R=403,L]

# Or

RewriteRule forbid/(.*)$ - [R=404,L]

# Extra Protection: (.htaccess 1 or .htaccess)

RewriteRule ^^/wp-content/themes/ - [L,R=403]
RewriteRule ^/wp-content/plugins/ - [L,R=403]

RewriteRule ^/wp-content/ - [L,R=403]Match "\.(my file here|my file here|aux)$">

# No: Logs:

RedirectMatch 404 \.log$

# Protect your themes style css file:

RewriteRule ^(.*)wp-content/themes/(.*)/style\.css$ - [R=404,L]

........................................................................................
........................................................................................
# Tor DDoS crawler:

RewriteCond %{HTTP_USER_AGENT}"=Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21" 
RewriteRule .* - [R=410,L]
         
# Bogus Firefox involved in DoS attacks:

RewriteCond %{HTTP_USER_AGENT}"=Mozilla/5.0 (X11; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0" 
RewriteRule .* - [R=410,L]

# Bogus Firefox involved in DoS attacks:

RewriteCond %{HTTP_USER_AGENT}"=Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" 
RewriteRule .* - [R=410,L]
 
........................................................................................

# Wget: All bots:

<IfModule mod_setenvif.c>
SetEnvIfNoCase User-Agent "^Wget.*" bad_bot
SetEnvIfNoCase User-Agent "^wget.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.4.0.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.5.2.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.5.3.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.6.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.7.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.1.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.1+cvs.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.2.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.9-beta.*" bad_bot
</IfModule>

# Alternative:

SetEnvIfNoCase User-Agent "^Wget.*" bad_bot
SetEnvIfNoCase User-Agent "^wget.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.4.0.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.5.2.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.5.3.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.6.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.7.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.1.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.1+cvs.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.8.2.*" bad_bot
SetEnvIfNoCase User-Agent "^Wget/1.9-beta.*" bad_bot

........................................................................................
........................................................................................
# PHP Hide  ###:
From: https://perishablepress.com

RewriteCond %{THE_REQUEST} .+\.php [NC]RewriteRule ^ - [F,L]

Hide: JS/php -ON BB PRO:
		
php 404.php https://exemple.se	
php 404.php https://www.exemple.se

//ALTENATIVE: 404.php https://www.exemple.se
	
js 404.php https://exemple.se	
js 404.php https://www.exemple.se

css 404.php https://exemple.se	
css 404.php https://www.exemple.se

BBQ PRO:
referrer=https:// 
referrer=http://		
........................................................................................
........................................................................................
# Block Proxy Servers via htaccess:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP:VIA}!^$ [OR]
RewriteCond %{HTTP:FORWARDED}!^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA}!^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR}!^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION}!^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION}!^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR}!^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP}!^$
RewriteRule ^(.*)$ - [F]</IfModule>

# If allowed Proxy:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:XROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:X-FORWARDED-FOR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$ [OR]
RewriteCond %{HTTP:FORWARDED-FOR} !^$ [OR]
RewriteCond %{HTTP:X-FORWARDED} !^$
RewriteCond %{HTTP_REFERER} !(.*)allowed-proxy-01.domain.tld(.*)
RewriteCond %{HTTP_REFERER} !(.*)allowed-proxy-02.domain.tld(.*)
RewriteCond %{HTTP_REFERER} !(.*)allowed-proxy-03.domain.tld(.*)
RewriteRule ^(.*)$ - [F]



# Alternative:(I use this)

ProxyRequests Off ProxyVia Off<Proxy *>Require all denied</Proxy>

........................................................................................
# File Injection Protection:

<IfModule mod_rewrite.c>
RewriteCond%{REQUEST_METHOD} GET
RewriteCond%{QUERY_STRING} [a-zA-Z0-9_]=https:// [OR]
RewriteCond%{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond%{QUERY_STRING} [a-zA-Z0-9_]=http%3A%2F%2F [OR]
RewriteCond%{QUERY_STRING} proc\/self\/environ [NC,OR]
RewriteCond%{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule .* - [F]
</IfModule>

........................................................................................

# Research scan bot:  A pain in the ass!

RewriteCond%{HTTP_USER_AGENT} ^research-scan-bot [NC,OR]

........................................................................................
# Pure Trash Requests (brute force attacks, etc)

RewriteCond%{QUERY_STRING}CONCAT[OR,NC]
RewriteCond%{QUERY_STRING union\+all\+select[OR,NC]
RewriteCond"%{HTTP_USER_AGENT}"sqlmap [NC]

.......................................................................................
.......................................................................................
# Block amazon cloud - HELL:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} ^https://(([^.]+\.)+)?amazonaws\.com [NC,OR]
RewriteCond %{REMOTE_HOST} ^.*\.amazonaws\.com$ [NC,OR]
RewriteCond %{REMOTE_HOST} ^mail(.*)\. [NC,OR]
RewriteCond %{REMOTE_HOST} ^smtp(.*)\. [NC]
RewriteRule ^(.*)$ - [F]</IfModule>

# Alternative:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} amazon\.com
RewriteRule ^/(.*)$ /$1 [F]
</IfModule>

# Alternative:

RewriteCond%{HTTP_REFERER}^http://.*amazonaws\.com [OR]
RewriteCond%{HTTP_REFERER}^https://.*amazonaws\.com [OR]
RewriteCond%{REMOTE_HOST}^.*\.compute-1\.amazonaws\.com$ [NC,OR]
RewriteCond%{HTTP_USER_AGENT}"AISearchBot"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"woriobot"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"heritrix"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"NetSeer"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"Nutch"[NC]
RewriteRule ^(.*)$ - [F]

* Amazon.com - useragents:
User-agent: Amazonbot               
Disallow: /
User-agent: Amazonbot/0.1
Disallow: /

Amazon IP:
23.22.35.
3.224.220.
52.70.240.

# Alternative:

<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} ^https://.*amazonaws\.com [OR]
RewriteCond %{REMOTE_HOST} ^.*\.compute-1\.amazonaws\.com$ [NC,OR]
RewriteRule ^(.*)$ – [F,L]</IfModule>

# Block a domainwho makes you crasy!:

SetEnvIfNoCase Referer "blockeddomain.com" blocked_domain
Order Allow,Deny
Allow from ALL
Deny from env=blocked_domain


#  ALTERNATIVE:
(DENY FROM) *amazonaws.com

#  Amazon.com /Hell!

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} amazon\.com
RewriteRule ^ - [NC,F,L]
</IfModule>

# I USE THIS: (2500117)
#* Bytespider tries to scrape my content:(  No  thanks!

<IfModule mod_rewrite.c>RewriteCond%{HTTP_REFERER}^https://.*amazonaws\.com [F] 
RewriteCond%{HTTP_REFERER}^https://.*amazon\.com [F]
RewriteCond%{HTTP_REFERER}^https://(([^.]+\.)+)?amazonaws\.com[F]
RewriteCond%{HTTP_REFERER}amazonaws\.com [NC]  
RewriteCond%{HTTP_REFERER}aws.amazon\.com [NC]
RewriteCond%{HTTP_REFERER}"^https?://(?:[^/]+\.)?amazonaws\.com" [NC,OR]
RewriteCond%{HTTP_REFERER}"^https?://(?:[^/]+\.)?amazon\.com" [NC,OR]
RewriteCond%{HTTP_REFERER}"^https?://(?:[^/]+\.)?Amazon\.com" [NC] 
RewriteCond%{REMOTE_HOST}^.*\.compute-1\.amazonaws\.com [NC,OR] 
RewriteCond%{REMOTE_HOST}^.*\1.compute.amazonaws\.com [NC,OR] 
RewriteCond%{REMOTE_HOST}^.*\2.compute.amazonaws\.com [NC,OR] 
RewriteCond%{REMOTE_HOST}^.*\.compute-2\.amazonaws\.com [NC,OR]
RewriteCond%{REMOTE_HOST}^.*\.us-west-2.compute.amazonaws\.com [NC,OR]
RewriteCond%{REMOTE_HOST}^.*\.eu-west-1.compute.amazonaws\.com [NC,OR]
RewriteCond%{REMOTE_HOST}^.*\.ap-south-1.compute.amazonaws\.com [NC,OR]
RewriteCond%{REMOTE_HOST}^.*\.compute-1.amazonaws\.com [NC,OR]
RewriteCond%{REMOTE_HOST}^.*\.ap-southeast-1.compute.amazonaws.com [NC,OR]
RewriteCond%{HTTP_USER_AGENT}"AISearchBot"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"Alexa"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"AlexaTM"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"Amazonbot/0.1"[NC,OR]  
RewriteCond%{HTTP_USER_AGENT}"amazon-kendra"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"Amazon Textract"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"Amazon Comprehend"[NC,OR]  
RewriteCond%{HTTP_USER_AGENT}"amazonbot"[NC,OR]   
RewriteCond%{HTTP_USER_AGENT}"Amazonbot"[NC,OR]  
RewriteCond%{HTTP_USER_AGENT}"Amazon Silk"[NC,OR] 
RewriteCond%{HTTP_USER_AGENT}"AMAZON-02"[NC,OR]  
RewriteCond%{HTTP_USER_AGENT}"Amazon Bedrock"[NC,OR] 
RewriteCond%{HTTP_USER_AGENT}"Amazon SageMaker"[NC,OR] 
RewriteCond%{HTTP_USER_AGENT}"Amazon: AWS"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"AWS Trainium"[NC,OR] 
RewriteCond%{HTTP_USER_AGENT}"Amazon Kendra"[NC,OR]
RewriteCond%{HTTP_USER_AGENT}"SurdotlyBot"[NC,OR]
RewriteCond%{REMOTE_ADDR}!^3\.6.93.227)$ [NC,OR]      #ClaudeBot AI 
RewriteCond%{REMOTE_ADDR}!^3\.21.98.184)$ [NC,OR      #ClaudeBot AI 
RewriteCond%{REMOTE_ADDR}!^3\.145.103.169)$ [NC,OR]   #ClaudeBot AI  
RewriteCond%{REMOTE_ADDR}!^3\.148.107.103)$ [NC,OR] 
RewriteCond%{REMOTE_ADDR}!^3\.148.107.103)$ [NC,OR] 
RewriteCond%{REMOTE_ADDR}!^3\.148.107.103)$ [NC,OR]
RewriteCond%{REMOTE_ADDR}!^13\.232.214.)$ [NC,OR]     #Image stealer India
RewriteCond%{REMOTE_ADDR}!^13\.232.214.104)$ [NC,OR]  #Image hacker
RewriteCond%{REMOTE_ADDR}!^34\.232.23.139)$ [NC,OR]   #SurdotlyBot
RewriteCond%{REMOTE_ADDR}!^47.128)$ [NC,OR]           #Bytesspider
RewriteCond%{REMOTE_ADDR}!^47.128.116.87)$ [NC,OR]    #Bytesspider
RewriteCond%{REMOTE_ADDR}!^47\.128.42.31)$ [NC,OR]    #Bytesspider
RewriteCond%{REMOTE_ADDR}!^47\.128.27.246)$ [NC,OR]   #Bytesspider
RewriteCond%{REMOTE_ADDR}!^47\.128.25.)$ [NC,OR]      #Bytesspider
RewriteCond%{REMOTE_ADDR}!^47\.128.54.92)$ [NC,OR]    #Bytesspider
RewriteCond%{HTTP_USER_AGENT}"Nutch"[NC]RewriteRule ^(.*)$ - [F,L]</IfModule>

.......................................................................................
.......................................................................................
# If needed: https:// on:
RewriteCond%{HTTPS}!on RewriteRule(.*)https://%{HTTP_HOST}%{REQUEST_URI}[L,R=301]

#Don't allow screenshots
RewriteCond %{REQUEST_URI} screenshot(?:\-\d+)?\.(?:jpe?g|png|gif)$ [NC,OR]

.......................................................................................
.......................................................................................
# Block tentatives to access Wordpress ressources
RewriteEngine on
RewriteRule ^(.*)wp-(.*)$ - [F]

.......................................................................................
.......................................................................................
# Add Apache rewrite rules to your .htaccess file. 
For example, the following will redirect all attempts to access files with names starting with, 
"phpMyAdmin" to index.php.


# Sample Apache Rewrite Rule

RewriteRule ^/phpMyAdmin.*$ /index.php

FOR plugins: //Test it!

RewriteRule ^/wp-content/plugins.*$ /index.php

Troubled Plugins:
RewriteRule ^/wp-content/plugins/plugin name.*$ /index.php

.......................................................................................
.......................................................................................
# Stop aggressive doamin:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http(s)?://(www.)?domain.com/.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(www.)?zurnasohbet.org/.*$ [NC]
RewriteRule .* - [F,L]


# IF put in exting site:
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http(s)?://(www.)?domain.com/.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(www.)?evilsite.org/.*$ [NC]
RewriteRule .* - [F,L]

.......................................................................................
.......................................................................................

# protect includesrss file!
RewriteRule^wp-includes/rss\.php$ - [R=404,L,NC] 

# ----------------------------------------------------------------------
# Prevent SSL cert warnings
# ----------------------------------------------------------------------

# Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent
# https://www.example.com when your cert only allows https://secure.example.com

<IfModule mod_rewrite.c>
RewriteCond %{SERVER_PORT}!^443
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>


# Sometimes: (protection)

RewriteEngine On RewriteCond %{REQUEST_FILENAME}!-f RewriteRule ^([^.]+)$ $1.php [NC,L]

.......................................................................................
.......................................................................................
#Humans.txt deny:

<IfModule mod_rewrite.c>RewriteRule ^([a-zA-Z0-9-_\/]+)humans.txt$ /humans.txt [F,L]</IfModule>

#ADS:
<IfModule mod_rewrite.c>RewriteRule ^([a-zA-Z0-9-_\/]+)ads.txt$ /humans.txt [F,L]</IfModule>

.......................................................................................
.......................................................................................
# Block them:

# China HELL: Unicom:
110.240.*.*
110.255.*.*

openbot // useragent honkong hell!

#Yandex bot:
By misstake I saw that this stops Yandex for visiting my blog.....

RewriteCond %{HTTP_USER_AGENT}^.*Android\/[1-14]\\.*[OR,NC] 


# Downloader from China:  Vistis again and again and try to download!  :(

RewriteCond%{HTTP_USER_AGENT}^.*UBrowser*[NC]
.......................................................................................
.......................................................................................
# WHEN yo are really tired of someone - mostly china/honkong/http//binance.com for me:

<IfModule mod_rewrite.c>
RewriteCond%{HTTP_REFERER}^Domainadreesshere.com/ RewriteRule /* https://www.porn300.com/sv/tagg/gratis-knull [R,L]
RewriteCond%{HTTP_REFERER}^.bc.googleusercontent.com/ RewriteRule /* https://www.porn300.com/sv/tagg/gratis-knull [R,L]
RewriteCond%{HTTP_REFERER}^.binance.com / RewriteRule /* https://www.porn300.com/sv/tagg/gratis-knull [R,L]
</IfModule>

.......................................................................................
.......................................................................................
# FONTS - Deny download:

To avoid the font files download change the permission of the font files directory of your site from 755 to 700.

Try and see if it works:)

.......................................................................................
.......................................................................................

#Binance  HELL:

RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.0(Linux; Android 10;JNY-LX1 Build/HUAWEIJNY-L21;wv)AppleWebKit/537.36(KHTML,like Gecko)Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 BNC/1.7.0 (Android 1.39.4))[NC] 
RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.0(Windows NT 10.0;Win64;x64)AppleWebKit/537.36(KHTML,like Gecko)Binance/1.26.0 Chrome/89.0.4389.128 Electron/12.0.7 Safari/537.36 (electron 1.26.0)Windows 10 desktop)[NC] 
RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.0(Windows NT 10.0;Win64;x64)AppleWebKit/537.36(KHTML,like Gecko)Binance/1.26.0 Chrome/89.0.4389.128 Electron/12.0.7 Safari/537.36 (electron 1.26.0)Windows 10 desktop)[NC] 
RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.0(Windows NT 10.0;Win64; x64)AppleWebKit/537.36(KHTML,like Gecko)Binance/1.26.0 Chrome/89.0.4389.128 Electron/12.0.7 Safari/537.36 (electron 1.26.0)Windows 10 desktop)[NC] 
RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.(Linux; Android 10;JNY-LX1 Build/HUAWEIJNY-L21;wv)AppleWebKit/537.36 (KHTML,like Gecko)Version/4.0 Chrome/105.0.0.0 Mobile Safari/537.36 BNC/1.7.0(Android 1.39.4)Android 10 Huawei P40 Lite)[NC] 
RewriteCond%{HTTP_USER_AGENT}(Mozilla/5.0(Linux; Android 10;JNY-LX1 Build/HUAWEIJNY-L21;wv)AppleWebKit/537.36 (KHTML,like Gecko)Version/4.0 Chrome/110.0.0.0 Mobile Safari/537.36 BNC/1.7.0(Android 1.39.4)Android 10 Huawei P40 Lite)[NC] 


EJ Komprimerad:
Mozilla/5.0 (Linux; Android 10; JNY-LX1 Build/HUAWEIJNY-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/110.0.0.0 Mobile Safari/537.36 BNC/1.7.0 (Android 1.39.4)	Android 10	Huawei P40 Lite
Mozilla/5.0 (Linux; Android 10; JNY-LX1 Build/HUAWEIJNY-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/105.0.0.0 Mobile Safari/537.36 BNC/1.7.0 (Android 1.39.4)	Android 10	Huawei P40 Lite
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Binance/1.26.0 Chrome/89.0.4389.128 Electron/12.0.7 Safari/537.36 (electron 1.26.0)	Windows 10	desktop
Mozilla/5.0 (Linux; Android 10; JNY-LX1 Build/HUAWEIJNY-L21; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 BNC/1.7.0 (Android 1.39.4)


Python and the Binance.com shitbags::
RewriteCond%{HTTP_USER_AGENT}^http-requests-binance.com-error-log [NC] 

RewriteCond%{HTTP_USER_AGENT}^HTTP/1.0-binance.com [NC]
RewriteCond%{HTTP_USER_AGENT}^HTTP/2.0-binance.com [NC]  
 
RewriteCond%{HTTP_USER_AGENT}^apache-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^Mozilla/5.0-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^linux-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^php-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^python-binance v1.0.19 [NC]
RewriteCond%{HTTP_USER_AGENT}^python-binance [NC]  
RewriteCond%{HTTP_USER_AGENT}^Mozilla/5.0-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^Windows NT 10.0-binance [NC]
RewriteCond%{HTTP_USER_AGENT}^Windows-binance [NC]
.......................................................................................
.......................................................................................
# Deny all methods except POST with htaccess:

RewriteCond %{REQUEST_METHOD}!POST
RewriteRule .* - [F]

2:
.htaccess at the beginning/ <IfModule mod_headers.c>

Header add Access-Control-Allow-Methods "POST"

3:  / did not work on my blog: but try:
<LimitExcept POST>
order deny,allow
deny from all
</LimitExcept>

.......................................................................................
.......................................................................................

# Secure cockeie:

<IfModule mod_headers.c>
Header always edit Set-Cookie (.*) "$1; HttpOnly."
Header always edit Set-Cookie (.*) "$1; Secure"
</IfModule>

#Alternative: Header extra security:  (sometimes slow down the site, try and see!)

Header set Set-Cookie HttpOnly;Secure 
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

In folders you want to protect:

RewriteEngine On
RewriteBase /
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{HTTP_COOKIE} !^.*HttpOnly.*$ [NC]
RewriteRule .* - [F]
</IfModule>


---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
# Errors -that not goes away! 

Set this: error_reporting(0);    in php file, under se example:


<?php
/*
Plugin Name: Header Example errornoway
*/
error_reporting(0);

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------

#Protect plugins /some plugins you need keep safe:
- All you have to do is add this code to your theme’s .HTACCESS file or in a site-specific plugin:


RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-plugins/NAME of the plugin/).* [NC]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ ///.*\ HTTP/HTTPS/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\?\=?(http|ftp|ssl|https):/.*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\?\?.*\ HTTP/HTTPS/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\.(phps|js|css).*\ HTTP/HTTPS/ [NC,OR]
RewriteRule .* - [F,NS,L]


---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
# THIS I am glad i found: #  //can make Google hates you!

themes:
<meta http-equiv="Expires" content="30">

as extra for expires in header, works so good, special on mobil sites:)
put it in themes header.


---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
#Block comment spammers, bad bots and some proxies:  
add your boots, ip numer

<IfModule mod_rewrite.c>

RewriteCond%{REMOTE_HOST} 11.111.111.111 [OR]

RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor [NC,OR]

RewriteCond %{HTTP_USER_AGENT} ^useragenthere [NC,OR]
RewriteRule ^.* - [F,L]

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
#Rate Limit:

# Images scrapers:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} !^/images/
RewriteRule ^(.*)$ - [E=RATE_LIMIT:1]
Header set Retry-After "5" env=RATE_LIMIT
</IfModule>

# DOS/scrapers limit:

<IfModule ratelimit_module>
SetOutputFilter RATE_LIMIT
SetEnv rate-limit 100
SetEnv rate-initial-burst 200
</IfModule>

#Alternative:

<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} !^/Post/
RewriteRule ^(.*)$ - [E=RATE_LIMIT:1]
Header set Retry-After "5" env=RATE_LIMIT
</ifModule>

## If you want them gone for a long time....

<IfModule mod_rewrite.c>
RewriteCond%{REQUEST_URI} !^/Post/
RewriteRule ^(.*)$ - [E=RATE_LIMIT:1]
Header set Retry-After "5550" env=RATE_LIMIT</ifModule>


#Add IP Adress:
<IfModule mod_ratelimit.c>
SetEnvIf Remote_Addr ".*" RATE_LIMIT
SetEnv rate-limit-interval "1800"                    # 1800 seconds = 30 minutes
SetEnv rate-limit-threshold "1"                      # 1 request per interval
</IfModule>

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
###Chrome Privacy Preserving Prefetch Proxy

RewriteEngine On
SetEnvIfNoCase X-Forwarded-For .+ proxy=yes
SetEnvIfNoCase X-moz prefetch no_access=yes

# block pre-fetch requests with X-moz headers
RewriteCond %{ENV:no_access} yes
RewriteRule .* - [F,L]

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
#BLOCK Scumbags:
# Start blocking on HTTP requests
RewriteCond %{HTTP_REFERER} "^https?://(?:[^/]+\.)?******\.com" [NC,OR]
RewriteCond %{HTTP_REFERER} "^https?://(?:[^/]+\.)?kambasoft\.com" [NC,OR]
RewriteCond %{HTTP_REFERER} "^https?://(?:[^/]+\.)?savetubevideo\.com" [NC]
RewriteRule ^.* - [F,L]

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
#FEED stealers: Send them somewhere on internet!

RewriteCond%{REMOTE_ADDR} ^123.123.123
RewriteRule ^(.*)$ http://domain.tld/feed

---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
#PROTECT FILES:  (Ends with php)

ALT 1: RewriteRule ^.*\.php$ - [F,L]

ALT 2: RedirectMatch 403 ^.*\.php$
---------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------
.......................................................................................
Updated: 250124