# Disable directory browsing
Options -Indexes

# Protect against XSS and other attacks
<IfModule mod_headers.c>
    # Security Headers
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    
    # HSTS (uncomment if you're using HTTPS)
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # Content Security Policy (adjust as needed)
    # Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net cdnjs.cloudflare.com; img-src 'self' data:;"
</IfModule>

# Protect sensitive files
<FilesMatch "^\.|composer\.json$|composer\.lock$|package\.json$|package-lock\.json$|webpack\.config\.js$|\.env$|.*\.sql$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Allow access to specific files
<FilesMatch "^(index\.php|login\.php|logout\.php|forgot-password\.php|reset-password\.php|setup-admin-db\.php)?$">
    Order allow,deny
    Allow from all
</FilesMatch>

# Block access to setup file after installation
<Files "setup-admin-db.php">
    Order allow,deny
    Deny from all
</Files>

# PHP settings
<IfModule mod_php7.c>
    php_flag display_errors off
    php_value max_execution_time 300
    php_value max_input_time 300
    php_value upload_max_filesize 64M
    php_value post_max_size 64M
    php_value memory_limit 256M
</IfModule>

# URL Rewriting
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # Force HTTPS (uncomment if using SSL)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    
    # Redirect www to non-www (or vice versa)
    # RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
    # RewriteRule ^(.*)$ https://%1/$1 [R=301,L]
    
    # Block access to hidden files and directories
    RewriteCond %{SCRIPT_FILENAME} -d [OR]
    RewriteCond %{SCRIPT_FILENAME} -f
    RewriteRule "(^|/)\." - [F]
    
    # Block access to specific file types
    <FilesMatch "\.(htaccess|htpasswd|ini|log|sh|sql|tpl|txt|xml|json|lock|md|gitignore|gitattributes|env|example|dist|config|inc|bak|save|swp|swo|~)$">
        Order Allow,Deny
        Deny from all
    </FilesMatch>
    
    # Allow access to assets
    RewriteRule ^(assets|css|js|img|fonts|vendor|uploads)/ - [L]
    
    # Protect against common exploits
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
    RewriteRule .* - [F]
    
    # Deny access to .git directory
    RewriteRule ^\.git - [F,L]
    
    # Deny access to .env file
    RewriteRule ^\.env - [F,L]
    
    # Deny access to composer files
    RewriteRule ^composer\.(json|lock) - [F,L]
    
    # Deny access to package files
    RewriteRule ^package(-lock)?\.json$ - [F,L]
</IfModule>

# Disable server signature
ServerSignature Off

# Set default charset
AddDefaultCharset UTF-8

# Set timezone (change to your timezone)
SetEnv TZ Asia/Kolkata

# Custom error pages
ErrorDocument 400 /error.php?code=400
ErrorDocument 401 /error.php?code=401
ErrorDocument 403 /error.php?code=403
ErrorDocument 404 /error.php?code=404
ErrorDocument 500 /error.php?code=500

# Disable ETags (helps with caching)
<IfModule mod_headers.c>
    Header unset ETag
    FileETag None
</IfModule>

# Enable compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
    
    # Remove browser bugs (only needed for really old browsers)
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
    
    # Compress HTML, CSS, JavaScript, Text, XML and fonts
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
    AddOutputFilterByType DEFLATE application/x-font
    AddOutputFilterByType DEFLATE application/x-font-opentype
    AddOutputFilterByType DEFLATE application/x-font-otf
    AddOutputFilterByType DEFLATE application/x-font-truetype
    AddOutputFilterByType DEFLATE application/x-font-ttf
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE font/otf
    AddOutputFilterByType DEFLATE font/ttf
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE image/x-icon
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/xml
    
    # Remove browser bugs (only needed for really old browsers)
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
</IfModule>

# Set cache control for static assets
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"
    
    # Images
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    
    # Video
    ExpiresByType video/mp4 "access plus 1 year"
    ExpiresByType video/mpeg "access plus 1 year"
    
    # CSS, JavaScript
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    
    # Web fonts
    ExpiresByType application/x-font-ttf "access plus 1 year"
    ExpiresByType font/opentype "access plus 1 year"
    ExpiresByType application/x-font-woff "access plus 1 year"
    ExpiresByType application/font-woff2 "access plus 1 year"
    ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
    
    # Others
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType application/x-shockwave-flash "access plus 1 month"
</IfModule>

# Set cache control headers for static assets
<IfModule mod_headers.c>
    <FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|svg|webp|woff|woff2|ttf|eot)$">
        Header set Cache-Control "max-age=31536000, public"
    </FilesMatch>
    
    <FilesMatch "\.(html|htm|php)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>
</IfModule>

# Disable server signature
ServerSignature Off

# Disable directory listing
Options -Indexes

# Block access to all .htaccess files
<files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy All
</files>

# Block access to sensitive files
<FilesMatch "^\.|composer\.json$|composer\.lock$|package\.json$|package-lock\.json$|webpack\.config\.js$|\.env$|.*\.sql$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Allow access to specific files
<FilesMatch "^(index\.php|login\.php|logout\.php|forgot-password\.php|reset-password\.php|setup-admin-db\.php|setup-directories\.php)$">
    Order allow,deny
    Allow from all
    Satisfy any
</FilesMatch>

# Block access to setup files after installation
# <Files "setup-*.php">
#     Order allow,deny
#     Deny from all
# </Files>
