Options -Indexes
DirectoryIndex index.php
LimitRequestBody 2097152

# Protect credentials, backups, logs, and deployment artifacts even if PHP/rewrite handling changes.
<FilesMatch "^(config\.php|\.env|\.htpasswd|composer\.(json|lock)|package(-lock)?\.json|README.*|.*\.(ini|log|sql|bak|old|orig|dist|sh))$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always unset X-Powered-By
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://www.google-analytics.com https://www.googletagmanager.com; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://www.googletagmanager.com; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests"
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine On

# Force the canonical HTTPS host. This also avoids Host-header based canonical confusion.
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^pagenostic\.com$ [NC]
RewriteRule ^ https://pagenostic.com%{REQUEST_URI} [R=301,L]

# Protect private/internal folders.
RewriteRule ^storage/ - [F,L]
RewriteRule ^pipe/ - [F,L]
RewriteRule ^includes/ - [F,L]
RewriteRule ^content/ - [F,L]

# SEO endpoints.
RewriteRule ^sitemap\.xml$ sitemap.php [L]
RewriteRule ^page-sitemap\.xml$ page-sitemap.php [L]
RewriteRule ^blog-sitemap\.xml$ blog-sitemap.php [L]
RewriteRule ^feed\.xml$ feed.php [L]

# Redirect old direct PHP URLs to clean URLs.
RewriteCond %{THE_REQUEST} \s/+index\.php[?\s] [NC]
RewriteRule ^index\.php$ / [R=301,L]
RewriteCond %{THE_REQUEST} \s/+about\.php[?\s] [NC]
RewriteRule ^about\.php$ /about/ [R=301,L]
RewriteCond %{THE_REQUEST} \s/+tester\.php[?\s] [NC]
RewriteRule ^tester\.php$ /tester/ [R=301,L]
RewriteCond %{THE_REQUEST} \s/+contact\.php[?\s] [NC]
RewriteRule ^contact\.php$ /contact/ [R=301,L]
RewriteCond %{THE_REQUEST} \s/+blog\.php[?\s] [NC]
RewriteRule ^blog\.php$ /blog/ [R=301,L]
RewriteCond %{THE_REQUEST} \s/+post\.php[?\s] [NC]
RewriteCond %{QUERY_STRING} (^|&)slug=([a-zA-Z0-9-]+)(&|$) [NC]
RewriteRule ^post\.php$ /blog/%2/? [R=301,L]

# Existing files and real directories work natively.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Legacy dynamic blog permalink fallback.
RewriteRule ^blog/([a-zA-Z0-9-]+)/?$ post.php?slug=$1 [L,QSA]
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/svg+xml "access plus 30 days"
  ExpiresByType image/x-icon "access plus 30 days"
</IfModule>
