# Hlaboi Apache security and clean URLs
Options -Indexes
DirectoryIndex index.php

# Force HTTPS (works behind normal cPanel Apache; remove if hosting already forces HTTPS via proxy)
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Block private/config/database/backup files
<FilesMatch "(?i)(^\.|\.env$|\.ini$|\.log$|\.sql$|\.bak$|\.old$|\.orig$|\.dist$|\.sh$|composer\.(json|lock)$|package(-lock)?\.json$|README.*|UPGRADE_NOTES\.txt$)">
  Require all denied
</FilesMatch>

# Do not allow direct browsing of configuration and storage internals
RedirectMatch 404 ^/(config|storage|vendor)/

# Do not execute PHP scripts inside uploaded media directories
<IfModule mod_rewrite.c>
  RewriteRule ^(assets/song-images|uploads|storage/uploads)/.*\.(php[0-9]?|phtml|phar)$ - [F,NC,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# Hide .php extensions for GET requests; existing .php URLs continue to work.
# Forms/actions using POST are not redirected.
RewriteCond %{REQUEST_METHOD} =GET
RewriteCond %{THE_REQUEST} \s/+(.+?)\.php(?:[?\s]) [NC]
RewriteRule ^(.+)\.php$ /$1 [R=301,L,NE]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+?)/?$ $1.php [L]
