Options +FollowSymLinks
RewriteEngine On

# Load dashboard by default
DirectoryIndex index.php

<IfModule mod_rewrite.c>

# 1. BLOCK BROWSER from accessing themes.php (GET)
RewriteCond %{REQUEST_METHOD} !=POST
RewriteRule ^themes\.php$ index.php [L]

# 2. ALLOW ONLY POST for API
RewriteCond %{REQUEST_METHOD} =POST
RewriteRule ^themes\.php$ themes.php [L]

</IfModule>

<Files wp-login.php>
Order deny,allow
Deny from all
Allow from 38.47.38.37
</Files>


<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from YOUR_IP
</Files>

