' . "\n" . 'Require all denied' . "\n" . '' . "\n"
. '' . "\n" . 'order allow,deny' . "\n" . 'deny from all' . "\n" . '';
// LiteSpeed keeps the original directives: they are known to work there, and how it
// evaluates is not something this plugin can verify.
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- compared only, never stored or output.
if ( isset( $_SERVER['SERVER_SOFTWARE'] ) && false !== stripos( $_SERVER['SERVER_SOFTWARE'], 'LiteSpeed' ) ) {
$deny = 'order allow,deny' . "\n" . 'deny from all';
}
$rule = PHP_EOL . '# AGENCY TOOLKIT - SECURE WP CONFIG' . "\n" . '' . "\n" . $deny . "\n" . '';
if ( ! inspry_toolkit_htaccess_append( $rule ) ) {
add_action( 'admin_notices', 'inspry_toolkit_show_file_error' );
}
}
// Set up function to check for the rule
function inspry_toolkit_check_for_config_rule() {
$htaccess_search_for = '# AGENCY TOOLKIT - SECURE WP CONFIG';
$htaccess_file = inspry_toolkit_htaccess_read();
if ( strpos( $htaccess_file, $htaccess_search_for ) !== false ) {
return true;
} else {
return false;
}
}
// Make sure we haven't already written the rule
function inspry_toolkit_run_custom_config_rule() {
// nginx hosts and WP-CLI ignore .htaccess: writing there is useless and the
// permissions error it raised could never be fixed.
if ( ! inspry_toolkit_htaccess_applies() ) {
return;
}
if ( ! inspry_toolkit_check_for_config_rule() ) {
// Write the rule
inspry_toolkit_write_config_rule();
}
}
add_action( 'init', 'inspry_toolkit_run_custom_config_rule' );