Options -Indexes
ServerSignature Off

# Custom error page
ErrorDocument 404 /404.php

# Protect sensitive folders from direct web access
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^includes/ - [F,L]
  RewriteRule ^database/ - [F,L]
  RewriteBase /
  RewriteRule ^sitemap\.xml$ sitemap.php [L,NC]
  RewriteRule ^feed\.xml$ feed.php [L,NC]
  RewriteRule ^llms\.txt$ llms.php [L,QSA,NC]
  RewriteRule ^llms-full\.txt$ llms.php?full=1 [L,QSA,NC]
  RewriteRule ^indexnow-key\.txt$ indexnow-key.php [L,NC]
  RewriteRule ^solutions/([a-z0-9-]+)/?$ service-single.php?slug=$1 [L,QSA,NC]
  RewriteRule ^industries/([a-z0-9-]+)/?$ industry-single.php?slug=$1 [L,QSA,NC]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Robots-Tag "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1" "expr=%{REQUEST_URI} !~ m#^/(admin|includes|database)/#"
</IfModule>

# Never serve dotfiles (.env, .git, etc.)
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Uncomment to force HTTPS once an SSL certificate is installed
# <IfModule mod_rewrite.c>
#   RewriteCond %{HTTPS} off
#   RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# </IfModule>

# Additional hardening
<IfModule mod_headers.c>
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self)"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

# Prevent PHP execution in user-uploaded content
<IfModule mod_rewrite.c>
  RewriteRule ^uploads/.*\.(?:php[0-9]?|phtml|phar)$ - [F,L,NC]
</IfModule>

<FilesMatch "(?i)^(composer\.(json|lock)|package(-lock)?\.json|README.*|DEPLOYMENT.*|CODE-RECHECK.*)$">
  Require all denied
</FilesMatch>
