# ==================================================================
# ستورك | Stoorak — server hardening & performance
# ==================================================================

# ---- Disable directory listing ----
Options -Indexes

# ---- Default document ----
DirectoryIndex index.php index.html

# ---- Force UTF-8 ----
AddDefaultCharset UTF-8

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block access to the data folder from the web
  RewriteRule ^data/ - [F,L]
  RewriteRule ^config/ - [F,L]
  RewriteRule ^includes/ - [F,L]
</IfModule>

# ---- Never serve raw data / credential files ----
<FilesMatch "\.(csv|json|log|ini|env|bak|sql|md)$">
  Require all denied
</FilesMatch>

# Allow the public JSON-free assets exception list
<Files "robots.txt">
  Require all granted
</Files>
<Files "sitemap.xml">
  Require all granted
</Files>

# ---- Security headers ----
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  Header always set X-XSS-Protection "1; mode=block"
  # Admin area must never be indexed
  <FilesMatch "^(login|dashboard|update-lead|export-csv|logout|thank-you)\.php$">
    Header always set X-Robots-Tag "noindex, nofollow, noarchive"
  </FilesMatch>
</IfModule>

# ---- Compression ----
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json image/svg+xml
</IfModule>

# ---- Browser caching ----
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# ---- Hide PHP signature ----
<IfModule mod_php.c>
  php_flag expose_php off
  php_flag display_errors off
</IfModule>

ErrorDocument 404 /index.php
