# ============================================
# ADVANCED ANTI-MALWARE PROTECTION - UPDATED
# Blocks: tkuvalis.com, verdman.com, 3 IPs
# Last Updated: Now
# ============================================
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (wprosacco|tkuvalis|verdman|j251010|uschimmel) [NC]
RewriteRule .* - [F,L]
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On

# Block ALL Known Malicious IPs
RewriteCond %{REMOTE_ADDR} ^198\.204\.225\.86$ [OR]
RewriteCond %{REMOTE_ADDR} ^198\.204\.225\. [OR]
RewriteCond %{REMOTE_ADDR} ^107\.150\.46\.245\. [OR]
RewriteCond %{REMOTE_ADDR} ^107\.150\.50\.154$ [OR]
RewriteCond %{REMOTE_ADDR} ^107\.150\.50\. [OR]
RewriteCond %{REMOTE_ADDR} ^107\.150\.
RewriteRule .* - [F,L]

# Block ALL Malicious Domains
RewriteCond %{HTTP_REFERER} tkuvalis\.com [NC,OR]
RewriteCond %{HTTP_REFERER} uschimmel.com [NC,OR]
RewriteCond %{HTTP_REFERER} verdman\.com [NC,OR]
RewriteCond %{QUERY_STRING} tkuvalis [NC,OR]
RewriteCond %{QUERY_STRING} verdman [NC,OR]
RewriteCond %{QUERY_STRING} j250914 [NC,OR]
RewriteCond %{QUERY_STRING} j250925 [NC,OR]
RewriteCond %{QUERY_STRING} j250929 [NC,OR]
RewriteCond %{QUERY_STRING} j251010 [NC]
RewriteRule .* - [F,L]

# Block Dangerous PHP Functions
RewriteCond %{QUERY_STRING} eval\( [NC,OR]
RewriteCond %{QUERY_STRING} curl_init [NC,OR]
RewriteCond %{QUERY_STRING} base64_decode [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode [NC,OR]
RewriteCond %{QUERY_STRING} system\( [NC,OR]
RewriteCond %{QUERY_STRING} exec\( [NC,OR]
RewriteCond %{QUERY_STRING} shell_exec [NC,OR]
RewriteCond %{QUERY_STRING} passthru [NC,OR]
RewriteCond %{QUERY_STRING} phpinfo [NC,OR]
RewriteCond %{QUERY_STRING} proc_open [NC,OR]
RewriteCond %{QUERY_STRING} popen [NC]
RewriteRule .* - [F,L]

# Block Suspicious User Agents
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} (libwww|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader|harvest|extract|grab|miner|bot|crawler) [NC]
RewriteRule .* - [F,L]

# Block Suspicious Request Methods
RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|PUT) [NC]
RewriteRule .* - [F,L]

# Block URL patterns used by malware
RewriteCond %{REQUEST_URI} init\.txt [NC,OR]
RewriteCond %{REQUEST_URI} init\.php [NC,OR]
RewriteCond %{REQUEST_URI} db\.php [NC]
RewriteRule .* - [F,L]
</IfModule>

# Block Malware Files by Name
<FilesMatch "^(db\.php|init\.txt|init\.php|config\.txt|shell\.php|c99\.php|r57\.php|backdoor\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Protect Configuration Files
<FilesMatch "(^\.env$|^wp-config\.php$|^config\.php$|^\.htaccess$|^configuration\.php$|^settings\.php$|^database\.php$)">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Disable Directory Browsing
Options -Indexes -FollowSymLinks

# Prevent Access to Hidden Files
<FilesMatch "^\.">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Block PHP Execution in Upload Folders
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} (uploads|files|media|tmp|temp|cache|images|assets)/.*\.(php|phtml|php3|php4|php5|php7|phar|phps)$ [NC]
RewriteRule . - [F,L]
</IfModule>

# Disable PHP in Specific Directories (if they exist)
<DirectoryMatch "^.*(uploads|tmp|temp|cache).*$">
    php_flag engine off
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</DirectoryMatch>

# Security Headers
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>

# Block File Uploads with PHP Extension
<IfModule mod_security.c>
    SecFilterEngine On
    SecFilterScanPOST On
</IfModule>