# BULLETPROOF .45.6 MAINTENANCE .HTACCESS FILE

# If for some strange reason your host does not have +FollowSymlinks enabled by default at
# the root level then you will need to enable Options +FollowSymlinks for mod_rewrite to work.
# If you are getting HTTP Error 500 Internal server errors and you have checked to make sure
# everything else is set correctly then remove the # sign in front of Options +FollowSymlinks
# below. If you are still getting 500 errors then immediately put the # sign back. All hosts
# these days should have this enabled by default. Enabling this will actually cause 500 server
# errors if your host has this enabled so you should probably never have to remove the # sign. 
# Options +FollowSymlinks

# The Most Common Apache Directives to force PHP5 to be used instead of PHP4
# Some web hosts have very specific directives - check with your web host first
# Remove the pound sign in front of AddType x-mapp-php5 .php for 1&1 web hosting
# AddType x-mapp-php5 .php
# Other common possibilities depending on your web host - check with your web host first
# AddHandler application/x-httpd-php5 .php
# AddHandler cgi-php5 .php

Options -Indexes

RewriteEngine On
RewriteBase /

# FILTER REQUEST METHODS
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]

# QUERY STRING EXPLOITS 
RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR] 
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR] 
RewriteCond %{QUERY_STRING} tag\= [NC,OR] 
RewriteCond %{QUERY_STRING} ftp\:  [NC,OR] 
RewriteCond %{QUERY_STRING} http\:  [NC,OR] 
RewriteCond %{QUERY_STRING} https\:  [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] 
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|’|"|;|\?|\*|=$).* [NC,OR] 
RewriteCond %{QUERY_STRING} ^.*(&#x22;|&#x27;|&#x3C;|&#x3E;|&#x5C;|&#x7B;|&#x7C;).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]  
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR] 
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR] 
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC] 
RewriteRule ^(.*)$ - [F,L]

# Remove the pound sign to make a condition active
# Add a pound sign to comment a condition out.
# Adding your IP address to the line below will display the website
# under maintenance page to ONLY you. For Testing purposes only.
# RewriteCond %{REMOTE_ADDR} ^75\.88\.99\.33$
# Adding your IP address to the line below will display the website
# under maintenance page to everyone else except you.
# Add your Public IP address to the line directly below.
RewriteCond %{REMOTE_ADDR} !^75\.88\.99\.33$

# RewriteCond sends all visitors to /bp-maintenance.php Website Under Maintenance page
# and displays the abstract-blue.png background image.
# If you added your IP address above your site will be online and accessible to only you.
RewriteCond %{REQUEST_URI} !^/bp-maintenance\.php$
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/bulletproof-security/abstract-blue-bg\.png$

# No matter what file was requested, serve bp-maintenance.php ONLY.
RewriteRule ^(.*)$ /bp-maintenance.php [L]

# If IP address is entered bypass / override bp-maintenance.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]