RewriteEngine On

# ─── Force HTTPS ──────────────────────────────────────────────────────────────
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ─── Default Index ────────────────────────────────────────────────────────────
DirectoryIndex index.php

# ─── Block Access to Sensitive Files ─────────────────────────────────────────
<FilesMatch "\.(json|log|sh|bak|env|sql|gz|tar|zip)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# ─── Block Direct Access to settings.php ─────────────────────────────────────
<Files "settings.php">
    Order Allow,Deny
    Deny from all
</Files>

# ─── Disable Directory Listing ────────────────────────────────────────────────
Options -Indexes

# ─── Security Headers ─────────────────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "no-referrer"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# ─── Block Common Attack Patterns ─────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2F|%2E%2E%2F) [NC,OR]
    RewriteCond %{QUERY_STRING} (union.*select|select.*from|insert.*into|drop.*table) [NC]
    RewriteRule .* - [F]
</IfModule>

# ─── Block Suspicious User Agents ─────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|nmap|masscan|zgrab|curl) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# ─── Limit Request Method ─────────────────────────────────────────────────────
<LimitExcept GET POST>
    Deny from all
</LimitExcept>
