Options -Indexes
ServerSignature Off

<IfModule mod_php.c>
  php_flag  display_errors  Off
  php_value upload_max_filesize 10M
  php_value post_max_size        12M
  php_value max_execution_time   60
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Force HTTPS — uncomment in production
  # RewriteCond %{HTTPS} off
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Block direct access to sensitive dirs
  RewriteRule ^(config|includes|database)/   - [F,L]
  RewriteRule ^\.env$                         - [F,L]

  # Pass existing files/dirs through
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Route clean URLs to folder index.php
  RewriteRule ^([a-z0-9\-]+)/?$           $1/index.php [L]
  RewriteRule ^admin/([a-z0-9\-]+)/?$     admin/$1/index.php [L]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options        "SAMEORIGIN"
  Header always set X-XSS-Protection       "1; mode=block"
  Header always set Referrer-Policy        "strict-origin-when-cross-origin"
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css               "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/jpeg             "access plus 6 months"
  ExpiresByType image/png              "access plus 6 months"
  ExpiresByType application/pdf        "access plus 1 month"
</IfModule>

ErrorDocument 404 /404.php
