RewriteEngine On

# --------------------------------------------------
# 🔒 FORCE HTTPS + WWW
# --------------------------------------------------
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www\.apexraylogistics\.com$ [NC]
RewriteRule ^ https://www.apexraylogistics.com%{REQUEST_URI} [R=301,L]

# --------------------------------------------------
# 🔐 BLOCK SENSITIVE FILES
# --------------------------------------------------
<FilesMatch "^(\.env|composer\.json|composer\.lock|package\.json|package-lock\.json|\.git)">
    Require all denied
</FilesMatch>

# Block backups and logs
<FilesMatch "\.(bak|sql|zip|tar|gz|log|sh|env)$">
    Require all denied
</FilesMatch>

# Block hidden files (except .well-known)
RedirectMatch 403 /\..*(?<!well-known)

# --------------------------------------------------
# 📁 BLOCK DIRECTORY LISTING
# --------------------------------------------------
Options -Indexes

# --------------------------------------------------
# 🧠 PROTECT .HTACCESS
# --------------------------------------------------
<Files .htaccess>
    Require all denied
</Files>

# --------------------------------------------------
# 🛡️ SECURITY HEADERS
# --------------------------------------------------
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# --------------------------------------------------
# ⚙️ PHP HANDLER (cPanel - DO NOT EDIT)
# --------------------------------------------------
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php81” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
