# Hardened root .htaccess

# Server Signature & Directory Browsing Restrictions
ServerSignature Off
Options -Indexes
Options -MultiViews

# HTTPS 301 Redirect & Comprehensive Directory Access Restrictions
<IfModule mod_rewrite.c>
    RewriteEngine On

    # HTTPS 301 Redirect (excluding localhost)
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP_HOST} !^localhost [NC]
    RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Route /api/v1/* to api_v1.php
    RewriteRule ^api/v1/(.*)$ api_v1.php?path=$1 [QSA,L]
    RewriteRule ^api/v1$ api_v1.php?path=/ [QSA,L]

    # Block access to protected directories (except acme-challenge)
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ [NC]
    RewriteRule ^(\.well-known|reports|logs|tests|\.git|\.idea|vendor|node_modules)(/|$) - [F,NC]
</IfModule>

# Comprehensive FilesMatch Pattern Blocking
<FilesMatch "(^error_log$|\.(log|sql|bak|old|tmp|swp|swo|env)$|~$|^\.DS_Store$|^Thumbs\.db$|^composer\.(json|lock)$|^package(-lock)?\.json$|^phpunit\.xml\.dist$|^\.git(ignore|attributes)$|^test_.*\.php$|^debug_.*\.php$|^config\.php$|^setup\.php$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>

# Security Headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://cdn.jsdelivr.net https://fonts.gstatic.com; connect-src 'self'"
</IfModule>

# PHP Flags
<IfModule mod_php7.c>
    php_flag display_errors Off
    php_flag expose_php Off
    php_value session.cookie_httponly 1
    php_value session.use_strict_mode 1
</IfModule>
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag expose_php Off
    php_value session.cookie_httponly 1
    php_value session.use_strict_mode 1
</IfModule>

# Gzip Compression (DEFLATE)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/x-javascript application/json application/xml
</IfModule>

# Browser Caching & Cache-Control Headers
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType application/x-javascript "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

