<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Redirect non-www to www
    RewriteCond %{HTTP_HOST} ^g-lineshippingcompany\.com [NC]
    RewriteRule ^(.*)$ https://www.g-lineshippingcompany.com/$1 [R=301,L]

    # Block common exploit scanners and bad bots
    RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|nmap|masscan|zgrab|python-requests|curl|wget|libwww|scrapy|go-http-client|dirbuster|gobuster|wfuzz|nuclei|httpx|havij|acunetix|nessus|openvas|w3af|burpsuite|zaproxy|arachni|vega|skipfish|whatweb|jbrofuzz|grabber|webscarab) [NC]
    RewriteRule .* - [F,L]

    # Block requests with no user agent
    RewriteCond %{HTTP_USER_AGENT} ^-?$
    RewriteRule .* - [F,L]

    # Block common attack patterns in query strings
    RewriteCond %{QUERY_STRING} (union.*select|insert.*into|drop.*table|script.*alert|base64_encode|eval\(|<script|\.\.\/|etc\/passwd|proc\/self|GLOBALS|REQUEST|mosConfig|_FILES) [NC]
    RewriteRule .* - [F,L]

    # Block common attack patterns in request URI
    RewriteCond %{REQUEST_URI} (\.php\.bak|\.sql|\.tar|\.gz|\.zip|wp-admin|wp-login|xmlrpc|phpmyadmin|adminer|\.git|\.svn|\.htpasswd|wp-content|wp-includes|cgi-bin) [NC]
    RewriteRule .* - [F,L]

    # Block suspicious request methods
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG|CONNECT) [NC]
    RewriteRule .* - [F,L]

    # Serve existing files/folders from public/ directory
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteCond %{DOCUMENT_ROOT}/public%{REQUEST_URI} -f
    RewriteRule ^(.*)$ /public/$1 [L]

    # Route everything else through public/index.php
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ /public/index.php [L]
</IfModule>

# Block sensitive files
<FilesMatch "\.(env|log|json|lock|sql|bat|sh|md|gitignore|gitattributes|editorconfig|bak|swp|tmp|sqlite|yml|yaml|xml|ini|conf)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block Laravel internals
<IfModule mod_rewrite.c>
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|PHPMailer|node_modules)(/.*)? - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# PHP settings
<IfModule mod_php.c>
    php_value upload_max_filesize 2M
    php_value post_max_size 2M
    php_value max_execution_time 30
    php_flag display_errors Off
    php_flag expose_php Off
</IfModule>

Options -Indexes
