## BEGIN Dragonizer [do not edit manually]

# ----------------------------------------
# Basic Configuration
# - Core server settings
# - Character encoding
# ----------------------------------------

# Character Encoding
AddDefaultCharset UTF-8
AddCharset UTF-8 .html .css .js .xml .json .txt

# Connection settings for HTTP/1.1 compatibility
<IfModule mod_headers.c>
    Header set Connection "keep-alive"
</IfModule>

# Disable Apache default ETag (keeps PHP-set ETag)
FileETag None

# XMLRPC Protection Rules
<Files xmlrpc.php>
	Order Deny,Allow
	Deny from all
</Files>

# ----------------------------------------
# SSL & Security Headers (Essential protection)
# - WWW redirection
# - HTTPS enforcement
# - Security headers
# ----------------------------------------

# Remove www from url
<IfModule mod_rewrite.c>
	RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
	RewriteRule ^ %{REQUEST_SCHEME}://%1%{REQUEST_URI} [R=301,L]
</IfModule>

# Force HTTPS
<IfModule mod_rewrite.c>
	RewriteCond %{HTTPS} !=on [NC]
	RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

# Set HTTP security headers
<IfModule mod_headers.c>
	Header set Access-Control-Allow-Methods "GET,POST"
	Header set Access-Control-Allow-Headers "Content-Type, Authorization"
	Header set Content-Security-Policy "upgrade-insecure-requests;"
	Header set X-Content-Security-Policy "default-src 'self'; img-src *; media-src * data:;"
	Header set Cross-Origin-Embedder-Policy "unsafe-none; report-to='default'"
	Header set Cross-Origin-Embedder-Policy-Report-Only "unsafe-none; report-to='default'"
	Header set Cross-Origin-Opener-Policy "unsafe-none"
	Header set Cross-Origin-Opener-Policy-Report-Only "unsafe-none; report-to='default'"
	Header set Access-Control-Allow-Origin "*"
	Header set Cross-Origin-Resource-Policy "cross-origin"
	Header set Permissions-Policy "accelerometer=(self), autoplay=(self), camera=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), picture-in-picture=(self), sync-xhr=(self), usb=(self)"
	Header set Referrer-Policy "strict-origin-when-cross-origin"
	Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
	Header set X-Content-Type-Options "nosniff"
	Header set X-Permitted-Cross-Domain-Policies "none"
</IfModule>

# ----------------------------------------
# 404 Error Handling (Improves response time)
# - Fast 404 responses
# - Resource filtering
# - Static file check
# ----------------------------------------

# Fast 404 Error Handling Rules
<IfModule mod_rewrite.c>
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteCond %{REQUEST_URI} !(robots\.txt|[a-z0-9_\-]*sitemap[a-z0-9_\-]*\.(xml|xsl)(\.gz)?|security\.txt) [NC]
	RewriteCond %{REQUEST_URI} !/$
	RewriteCond %{REQUEST_URI} !-\d+x\d+\.(jpg|jpeg|png|gif)$ [NC]
	RewriteCond %{REQUEST_FILENAME} \.(css|js|js2|js3|js4|svg|xml|ico|jpg|jpeg|jpe|webp|json|png|svg|svgz|cur|ttf|ttc|_ttf|woff|woff2|html|htm)$ [NC]
	RewriteRule .* - [L,B]
</IfModule>

## END Dragonizer [do not edit manually]


# BEGIN Kadence Security - این خط را اصلاح یا حذف نکنید
# Kadence Security Config Details: 2
	# از فایل های سیستم محافظت کنید - امنیت > تنظیمات > تنظیمات سیستم > فایل های سیستم
	<files .htaccess>
		<IfModule mod_litespeed.c>
			Order allow,deny
			Deny from all
		</IfModule>
	</files>
	<files readme.html>
		<IfModule mod_litespeed.c>
			Order allow,deny
			Deny from all
		</IfModule>
	</files>
	<files readme.txt>
		<IfModule mod_litespeed.c>
			Order allow,deny
			Deny from all
		</IfModule>
	</files>
	<files wp-config.php>
		<IfModule mod_litespeed.c>
			Order allow,deny
			Deny from all
		</IfModule>
	</files>

	# مرور دایرکتوری - امنیت > تنظیمات > تنظیمات سیستم > مرور دایرکتوری را غیرفعال کنید
	Options -Indexes

	<IfModule mod_rewrite.c>
		RewriteEngine On

		# از فایل های سیستم محافظت کنید - امنیت > تنظیمات > تنظیمات سیستم > فایل های سیستم
		RewriteRule ^wp-admin/install\.php$ - [F]
		RewriteRule ^wp-admin/includes/ - [F]
		RewriteRule !^wp-includes/ - [S=3]
		RewriteRule ^wp-includes/[^/]+\.php$ - [F]
		RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F]
		RewriteRule ^wp-includes/theme-compat/ - [F]
		RewriteRule (^|.*/)\.(git|svn) - [F]

		# غیرفعال کردن PHP در آپلودها - امنیت > تنظیمات > تنظیمات سیستم > PHP در آپلودها
		RewriteRule ^wp\-content/uploads/.*\.(?:php[1-7]?|pht|phtml?|phps)\.?$ - [NC,F]

		# غیرفعال کردن PHP در افزونه ها - امنیت > تنظیمات > تنظیمات سیستم > PHP در افزونه ها
		RewriteRule ^wp\-content/plugins/.*\.(?:php[1-7]?|pht|phtml?|phps)\.?$ - [NC,F]

		# غیرفعال کردن PHP در قالب - امنیت > تنظمیات > ترفندهای سیستم > PHP در قالب ها
		RewriteRule ^wp\-content/themes/.*\.(?:php[1-7]?|pht|phtml?|phps)\.?$ - [NC,F]
	</IfModule>
# END Kadence Security - این خط را اصلاح یا حذف نکنید


# BEGIN LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule litespeed/debug/.*\.log$ - [F,L]
RewriteRule \.litespeed_conf\.dat - [F,L]
</IfModule>
<IfModule LiteSpeed>
CacheLookup on
RewriteRule .* - [E=Cache-Control:no-autoflush]

### marker ASYNC start ###
RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=async_litespeed
RewriteRule .* - [E=noabort:1]
### marker ASYNC end ###

### marker MOBILE start ###
RewriteCond %{HTTP_USER_AGENT} Mobile|Android|Silk/|Kindle|BlackBerry|Opera\ Mini|Opera\ Mobi [NC]
RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+ismobile]
### marker MOBILE end ###

### marker DROPQS start ###
CacheKeyModify -qs:fbclid
CacheKeyModify -qs:gclid
CacheKeyModify -qs:utm*
CacheKeyModify -qs:_ga
### marker DROPQS end ###

</IfModule>
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END LSCACHE
# BEGIN NON_LSCACHE
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
## LITESPEED WP CACHE PLUGIN - Do not edit the contents of this block! ##
# END NON_LSCACHE

# BEGIN WordPress
# دستورالعمل‌های (خطوط) بین "BEGIN WordPress" و "END WordPress"
# به طور پویا تولید شده‌اند، و فقط باید به وسیلهٔ صافی‌های وردرپرس ویرایش شوند.
# هر تغییری در دستورالعمل‌های بین این نشان‌گرها بازنویشی خواهند شد.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
   php_flag display_errors Off
   php_value error_log "error_log"
   php_flag log_errors On
   php_value max_execution_time 60
   php_value max_input_time 360
   php_value max_input_vars 10000
   php_value memory_limit 512M
   php_value post_max_size 30M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_value upload_max_filesize 30M
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors Off
   php_value error_log "error_log"
   php_flag log_errors On
   php_value max_execution_time 60
   php_value max_input_time 360
   php_value max_input_vars 10000
   php_value memory_limit 512M
   php_value post_max_size 30M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_value upload_max_filesize 30M
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit