# BEGIN Forçar HTTPS e HSTS
<IfModule mod_rewrite.c>
RewriteEngine On

# FORÇAR HTTPS (se seu site já tem SSL)
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Preserva autorização HTTP para alguns plugins/REST
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# HSTS (apenas se tiver HTTPS configurado corretamente)
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>
# END Forçar HTTPS e HSTS

# BEGIN Segurança básica
# Impede listagem de diretórios
Options -Indexes

# Protege .htaccess e wp-config.php de leitura pública
<FilesMatch "^(\.htaccess|wp-config\.php|readme\.html|license\.txt)$">
    Require all denied
</FilesMatch>

# Bloqueia tentativas simples de exploração de xmlrpc (opcional)
<Files xmlrpc.php>
    Require all denied
</Files>

# Desabilita execução de PHP em uploads (previne upload+exec)
<Directory "/path/to/your/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>
# OBS: ajuste o path acima se necessário ou remova se seu host não permitir <Directory> em .htaccess

# Protege wp-includes
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
# END Segurança básica

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# Se o pedido não for um arquivo ou diretório existente, direciona para index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# BEGIN Cache/Compress (opcional; comente se seu host já faz isso)
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 30 days"
    ExpiresByType image/jpeg "access plus 30 days"
    ExpiresByType image/gif "access plus 30 days"
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType text/javascript "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType text/html "access plus 1 day"
</IfModule>
# Fim cache