Your .htaccess files.
Finally work with OpenLiteSpeed.

# Enable brute force protection
BruteForceProtection On
BruteForceAllowedAttempts 5
BruteForceWindow 300
BruteForceAction throttle

# Behind Cloudflare/proxy
BruteForceXForwardedFor On

# Whitelist trusted IPs (CIDR supported)
BruteForceWhitelist 10.0.0.0/8, 192.168.1.0/24, 203.0.113.100

# Protect custom admin areas
BruteForceProtectPath /admin/
BruteForceProtectPath /api/login

# Actions: block (403), log (allow but log), throttle (progressive delays)
# Throttle levels: soft (2s), medium (5s), hard (15s)

# Security Headers
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Strict-Transport-Security "max-age=31536000"

# CORS Headers
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"

# Cache Control
Header set Cache-Control "public, max-age=3600"

# Remove Headers
Header unset X-Powered-By

# Append to Existing
Header append Vary "Accept-Encoding"

# Memory and Upload Limits
php_value memory_limit 768M
php_value upload_max_filesize 150M
php_value post_max_size 150M
php_value max_execution_time 600
php_value max_input_time 600

# Error Handling and Logging
php_flag display_errors On
php_flag log_errors On
php_admin_value error_log /var/log/php-errors.log

# Security Settings
php_admin_flag allow_url_fopen Off
php_admin_flag allow_url_include Off

# Date and Time
php_value date.timezone "America/New_York"
php_value default_charset "UTF-8"

# Session Configuration
php_value session.gc_maxlifetime 7200
php_flag session.use_strict_mode On

# Whitelist Approach - Block all except allowed
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
Allow from 10.0.0.5

# Blacklist Approach - Allow all except denied
Order allow,deny
Allow from all
Deny from 203.0.113.0/24

# Complex Rules
Order deny,allow
Deny from all
Allow from 192.168.0.0/16    # Internal network
Allow from 10.0.0.0/8         # VPN
Allow from 172.16.0.0/12      # Private subnet

# Simple Redirects
Redirect 301 /old-page /new-page
Redirect permanent /old-url https://new-domain.com/page

# Regex Pattern Matching with RedirectMatch
RedirectMatch 301 ^/blog/(.*)$ /news/$1
RedirectMatch permanent ^/products/(.+)\.html$ /shop/$1

# Enforce trailing slashes
RedirectMatch 301 ^/(.+[^/])$ /$1/

# Category redirects with capture groups
RedirectMatch 301 ^/category/([^/]+)/page/([0-9]+)$ /cat/$1?p=$2

# Custom Error Pages
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

# Cache Control for Static Files
<FilesMatch "\.(jpg|png|gif|css|js)$">
    Header set Cache-Control "max-age=31536000"
</FilesMatch>

# Expires Directives
ExpiresActive On
ExpiresByType image/jpeg A31557600
ExpiresByType text/css A2592000

# Environment Variables
SetEnv APPLICATION_ENV production
SetEnvIf User-Agent ".*Mobile.*" mobile_device
BrowserMatch "MSIE" old_browser

# Request Headers
RequestHeader set X-Forwarded-Proto "https"