# Afrochip: Apache settings for cPanel hosting

# ---- Force HTTPS and the www address ----
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://www.afrochip.com%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^afrochip\.com$ [NC]
RewriteRule ^ https://www.afrochip.com%{REQUEST_URI} [L,R=301]

# ---- Block files that should never be downloaded ----
<FilesMatch "(^\.|\.(sql|md|log|ini|bak|sh|env|lock)$|^composer\.)">
  Require all denied
</FilesMatch>
Options -Indexes

# ---- Security headers ----
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
  # The page shell must never be cached stale; assets are versioned by query string.
  <FilesMatch "\.(html)$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
  <FilesMatch "\.(css|js|jpg|png|svg|json)$">
    Header set Cache-Control "public, max-age=86400"
  </FilesMatch>
</IfModule>

# ---- PHP hardening (applies where the host allows php_flag; cPanel MultiPHP INI Editor also works) ----
<IfModule mod_php.c>
  php_flag display_errors Off
  php_flag expose_php Off
  php_value post_max_size 1M
</IfModule>

# ---- Compression ----
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

DirectoryIndex index.html
