wordpress - .htaccess

# Leverage Browser Caching by SG-Optimizer
<IfModule mod_expires.c>
    ExpiresActive on
    ExpiresDefault                                      "access plus 2 months"
  # CSS
    ExpiresByType text/css                              "access plus 4 hours"
  # Data interchange
    ExpiresByType application/json                      "access plus 0 seconds"
    ExpiresByType application/xml                       "access plus 0 seconds"
    ExpiresByType text/xml                              "access plus 0 seconds"
  # Favicon (cannot be renamed!)
    ExpiresByType image/x-icon                          "access plus 1 week"
  # HTML components (HTCs)
    ExpiresByType text/x-component                      "access plus 2 months"
  # HTML
    ExpiresByType text/html                             "access plus 0 seconds"
  # JavaScript
    ExpiresByType application/javascript                "access plus 4 hours"
  # Manifest files
    ExpiresByType application/x-web-app-manifest+json   "access plus 0 seconds"
    ExpiresByType text/cache-manifest                   "access plus 0 seconds"
  # Media
    ExpiresByType audio/ogg                             "access plus 2 months"
    ExpiresByType image/gif                             "access plus 2 months"
    ExpiresByType image/jpeg                            "access plus 2 months"
    ExpiresByType image/png                             "access plus 2 months"
    ExpiresByType video/mp4                             "access plus 2 months"
    ExpiresByType video/ogg                             "access plus 2 months"
    ExpiresByType video/webm                            "access plus 2 months"
  # Web feeds
    ExpiresByType application/atom+xml                  "access plus 1 hour"
    ExpiresByType application/rss+xml                   "access plus 1 hour"
  # Web fonts
    ExpiresByType application/font-woff                 "access plus 2 months"
    ExpiresByType application/font-woff2                "access plus 2 months"
    ExpiresByType application/vnd.ms-fontobject         "access plus 2 months"
    ExpiresByType application/x-font-ttf                "access plus 2 months"
    ExpiresByType font/opentype                         "access plus 2 months"
    ExpiresByType image/svg+xml                         "access plus 2 months"
</IfModule>
# END LBC
# GZIP enabled by SG-Optimizer
<IfModule mod_deflate.c>
    <IfModule mod_filter.c>
       AddOutputFilterByType DEFLATE "application/atom+xml" \
          "application/javascript" \
          "application/json" \
          "application/ld+json" \
          "application/manifest+json" \
          "application/rdf+xml" \
          "application/rss+xml" \
          "application/schema+json" \
          "application/vnd.geo+json" \
          "application/vnd.ms-fontobject" \
          "application/x-font-ttf" \
          "application/x-javascript" \
          "application/x-web-app-manifest+json" \
          "application/xhtml+xml" \
          "application/xml" \
          "font/eot" \
          "font/opentype" \
          "image/bmp" \
          "image/svg+xml" \
          "image/vnd.microsoft.icon" \
          "image/x-icon" \
          "text/cache-manifest" \
          "text/css" \
          "text/html" \
          "text/javascript" \
          "text/plain" \
          "text/vcard" \
          "text/vnd.rim.location.xloc" \
          "text/vtt" \
          "text/x-component" \
          "text/x-cross-domain-policy" \
          "text/xml"
    </IfModule>
</IfModule>
# END GZIP

# Protect Section

<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>

<files wp-config.php>
order allow,deny
deny from all
</files>

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>


# Protect Section

# Static Files
<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !(robots\.txt|sitemap\.xml(\.gz)?)
        RewriteCond %{REQUEST_FILENAME} \.(css|js|html|htm|rtf|rtx|svg|svgz|txt|xsd|xsl|xml|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|swf|tar|tif|tiff|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$ [NC]
        RewriteRule .* - [L]
</IfModule>
# Static Files

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

wp-content .htaccess

Order deny,allow
Deny from all
<FilesMatch "\.(?i:xml|css|jpe?g|png|gif|js|ttf|woff|woff2)$">
Allow from all
</FilesMatch>