# 1. PROTEGER CONTRA ATAQUES XML-RPC
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

# 2. FILTRO DE ACCESO MAESTRO GLOBAL
RewriteEngine On
RewriteBase /

# PASO A: Captura el dominio dinámicamente y asigna la cookie sin importar el subdominio
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.*)$ [NC]
RewriteRule ^acc_zippy_entrar$ wp-login.php [CO=zippy_pass:authorized:%1:1440:/:secure:HttpOnly,L,R=302]

# PASO B: Salvoconducto imprescindible para recursos visuales y la trampa
RewriteCond %{REQUEST_URI} (trampa-error\.php|\.(css|js|png|jpg|jpeg|gif|svg|ico|woff|woff2))$ [NC]
RewriteRule ^ - [L]

# PASO C: Muro Definitivo
RewriteCond %{HTTP:Cookie} !zippy_pass=authorized
RewriteRule ^(.*)$ trampa-error.php [L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress