diff --git a/abra.sh b/abra.sh
index d087fa6..21dcf5c 100644
--- a/abra.sh
+++ b/abra.sh
@@ -2,7 +2,7 @@ export PHP_UPLOADS_CONF_VERSION=v4
 export ENTRYPOINT_CONF_VERSION=v8
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
-export HTACCESS_CONF_VERSION=v3
+export HTACCESS_CONF_VERSION=v4
 export USERS_CONF_VERSION=v1
 
 wp() {
diff --git a/htaccess.tmpl b/htaccess.tmpl
index 11b2574..a682446 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -3,6 +3,19 @@
     Require all denied
 </FilesMatch>
 
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>
+
+# Block wp2shell CVE-2026-63030
+<IfModule mod_rewrite.c>
+RewriteEngine On
+RewriteCond %{QUERY_STRING} rest_route=.*/batch/v1 [NC]
+RewriteRule .* - [F,L]
+RewriteRule ^wp-json/batch/v1 - [F,L]
+</IfModule>
+
 {{ if eq (env "MULTISITE") "" -}}
 # BEGIN WordPress
 
@@ -59,9 +72,4 @@ RewriteRule ^(.*\.php)$ $1 [L]
 RewriteRule . index.php [L]
 
 # END WordPress Multisite
-{{- end }}
-
-# Block XML-RPC
-<Files xmlrpc.php>
-    Require all denied
-</Files>
+{{- end }}
\ No newline at end of file