Wow you are really fast đ Thank you for quick response.
Yes and I want mainly use the both. The injection-proof structure you got is very good and I want to combine it with the url hiding. I am in the same opinion with you that it could take as short as 6 secs to discover real url by an hacker. But the hiding thing is not for the hackers, it is mainly for common people đ
So about the problem: it does exits the loop if I delete custom code created by Better WP Security (additional to the steps above). So the whole url hiding thing blows.
The code I combined with yours is:
# BEGIN Better WP Security
Options -Indexes
<files .htaccess>
Order allow,deny
Deny from all
</files>
<files readme.html>
Order allow,deny
Deny from all
</files>
<files readme.txt>
Order allow,deny
Deny from all
</files>
<files install.php>
Order allow,deny
Deny from all
</files>
<files wp-config.php>
Order allow,deny
Deny from all
</files>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-admin/includes/ – [F,L]
RewriteRule !^wp-includes/ – [S=3]
RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
RewriteRule ^wp-includes/[^/]+\.php$ – [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php – [F,L]
RewriteRule ^wp-includes/theme-compat/ – [F,L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ – [F,L]
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^(.*)wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !^(.*).*
RewriteCond %{HTTP_REFERER} !^http://jetpack\.wordpress\.com/jetpack-comment/ [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$ – [F,L]
RewriteRule ^login-the-site/?$ /my-website-root/wp-login.php?ivqpurjtbs422uawzih0y [R,L]
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
RewriteRule ^manage/?$ /my-website-root/wp-login.php?ivqpurjtbs422uawzih0y&redirect_to=/my-website-root/wp-admin/ [R,L]
RewriteRule ^manage/?$ /my-website-root/wp-admin/?ivqpurjtbs422uawzih0y [R,L]
RewriteRule ^register/?$ /my-website-root/wp-login.php?ivqpurjtbs422uawzih0y&action=register [R,L]
RewriteCond %{SCRIPT_FILENAME} !^(.*)admin-ajax\.php
RewriteCond %{HTTP_REFERER} !^(.*)/my-website-root/wp-admin
RewriteCond %{HTTP_REFERER} !^(.*)/my-website-root/wp-login\.php
RewriteCond %{HTTP_REFERER} !^(.*)/my-website-root/login-the-site
RewriteCond %{HTTP_REFERER} !^(.*)/my-website-root/manage
RewriteCond %{HTTP_REFERER} !^(.*)/my-website-root/register
RewriteCond %{QUERY_STRING} !^ivqpurjtbs422uawzih0y
RewriteCond %{QUERY_STRING} !^action=logout
RewriteCond %{QUERY_STRING} !^action=rp
RewriteCond %{QUERY_STRING} !^action=register
RewriteCond %{QUERY_STRING} !^action=postpass
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
RewriteRule ^.*wp-admin/?|^.*wp-login\.php /my-website-root/not_found [R,L]
RewriteCond %{QUERY_STRING} ^loggedout=true
RewriteRule ^.*$ /my-website-root/wp-login.php?ivqpurjtbs422uawzih0y [R,L]
</IfModule>
# END Better WP Security
