Options -Indexes -MultiViews
Options +FollowSymLinks

# ── REWRITE ENGINE ──────────────────────────────────────────────
RewriteEngine On

# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Remove trailing slash (except root)
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)/$ /$1 [L,R=301]

# Serve real files & directories directly
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Route everything else through index.php / router
RewriteRule ^ index.php [L]

# ── SECURITY HEADERS ────────────────────────────────────────────
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options    "nosniff"
  Header always set X-Frame-Options           "SAMEORIGIN"
  Header always set X-XSS-Protection          "1; mode=block"
  Header always set Referrer-Policy           "strict-origin-when-cross-origin"
  Header always set Permissions-Policy        "geolocation=(), microphone=(), camera=()"
  Header always unset X-Powered-By
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

# ── COMPRESSION ─────────────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css
  AddOutputFilterByType DEFLATE application/javascript application/json
  AddOutputFilterByType DEFLATE application/xml text/xml image/svg+xml
  AddOutputFilterByType DEFLATE font/woff2 font/woff font/ttf
</IfModule>

# ── BROWSER CACHING ─────────────────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/png              "access plus 7 days"
  ExpiresByType image/jpeg             "access plus 7 days"
  ExpiresByType image/gif              "access plus 7 days"
  ExpiresByType image/svg+xml         "access plus 7 days"
  ExpiresByType image/webp             "access plus 7 days"
  ExpiresByType image/x-icon           "access plus 30 days"
  ExpiresByType text/css               "access plus 3 days"
  ExpiresByType application/javascript "access plus 3 days"
  ExpiresByType application/json       "access plus 1 hour"
  ExpiresByType text/html              "access plus 0 seconds"
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "\.(css|js)$">
    Header set Cache-Control "public, max-age=259200"
  </FilesMatch>
  <FilesMatch "\.(png|jpg|jpeg|gif|ico|webp|svg)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
  <FilesMatch "\.(html|php)$">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
  </FilesMatch>
</IfModule>

# ── BLOCK BAD BOTS ──────────────────────────────────────────────
<IfModule mod_rewrite.c>
  RewriteCond %{HTTP_USER_AGENT} (ahrefs|mj12bot|dotbot|semrushbot|blexbot) [NC]
  RewriteRule .* - [F,L]
</IfModule>

# ── PROTECT SENSITIVE FILES ─────────────────────────────────────
<FilesMatch "(\.env|composer\.(json|lock)|package(-lock)?\.json|\.git)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# ── DEFAULT CHARSET ─────────────────────────────────────────────
AddDefaultCharset UTF-8
