# MOHIRA TEXTILES - Production Ready - Secure
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# Prevent directory listing
Options -Indexes

# Protect sensitive files and directories - BLOCK DIRECT ACCESS
<FilesMatch "^(config\.php|database\.php|\.htaccess|.*\.json|\.env|.*\.log)$">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order allow,deny
Deny from all
</IfModule>
</FilesMatch>

# Block access to admin/data, includes, admin/includes via URL
RewriteRule ^(admin/data|includes|admin/includes|admin_backup)/ - [F,L]

# Allow robots and sitemap
RewriteRule ^(robots\.txt|sitemap\.php)$ - [L]

</IfModule>

# Security Headers
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
Header unset X-Powered-By
Header unset Server
</IfModule>

# Caching
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType video/mp4 "access plus 1 month"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
</IfModule>

# Compression
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json
</IfModule>

# PHP Security
<IfModule mod_php7.c>
php_flag display_errors off
php_flag log_errors on
php_value error_reporting E_ALL & ~E_NOTICE & ~E_DEPRECATED
</IfModule>
