Options -Indexes -ExecCGI

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Force HTTPS — uncomment once SSL certificate is active on live server
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Redirect non-www to www
    # RewriteCond %{HTTP_HOST} ^g-lineshippingcompany\.com [NC]
    # RewriteRule ^(.*)$ https://www.g-lineshippingcompany.com/$1 [R=301,L]

    # Block common exploit scanners and bad bots
    RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|nmap|masscan|zgrab|python-requests|curl|wget|libwww|scrapy|go-http-client|dirbuster|gobuster|wfuzz|nuclei|httpx) [NC]
    RewriteRule .* - [F,L]

    # Block requests with no user agent
    RewriteCond %{HTTP_USER_AGENT} ^-?$
    RewriteRule .* - [F,L]

    # Block common attack patterns in query strings
    RewriteCond %{QUERY_STRING} (union.*select|insert.*into|drop.*table|script.*alert|base64_encode|eval\(|<script|\.\.\/|etc\/passwd|proc\/self) [NC]
    RewriteRule .* - [F,L]

    # Block common attack patterns in request URI
    RewriteCond %{REQUEST_URI} (\.php\.bak|\.sql|\.tar|\.gz|\.zip|wp-admin|wp-login|xmlrpc|phpmyadmin|adminer) [NC]
    RewriteRule .* - [F,L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Block access to hidden files (except .well-known for SSL)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/
    RewriteRule ^\..*$ - [F,L]
</IfModule>

# Block sensitive file types
<FilesMatch "\.(env|log|json|lock|sql|bat|sh|md|gitignore|gitattributes|editorconfig|bak|swp|tmp|sqlite|yml|yaml|ini|conf)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://unpkg.com https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://*.tile.openstreetmap.org; connect-src 'self'"
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# PHP security settings
<IfModule mod_php.c>
    php_value upload_max_filesize 2M
    php_value post_max_size 2M
    php_value max_execution_time 30
    php_value max_input_time 30
    php_flag display_errors Off
    php_flag expose_php Off
</IfModule>

# Cache static assets
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType application/x-font-woff "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>
