# =========================================================================
# UNIVERSAL ENTERPRISE .HTACCESS HARDENING
# EddieDigitalSolutions Universal Protection Protocol v3.0
# =========================================================================

# 1. DIRECTORY SECURITY & DEFAULT INDEX
DirectoryIndex index.php index.html
Options -Indexes -FollowSymLinks +SymLinksIfOwnerMatch

# 2. HTTPS 301 ENFORCEMENT & CANONICAL HOSTING
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Redirect HTTP to HTTPS
  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Block hidden files and directories (except .well-known for Let's Encrypt SSL)
  RewriteRule (^|/)\.(?!well-known) - [F]

  # Block direct execution of PHP scripts in upload/asset folders
  RewriteRule ^(images|Images|assets|uploads)/.*\.php$ - [F,L,NC]
</IfModule>

# 3. SENSITIVE FILE & RECONNAISSANCE LOCKDOWN
<FilesMatch "(^\.env|\.(sql|log|ini|sh|bak|swp|md|git|yml|yaml|conf|twig)$|composer\.(json|lock))">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# 4. OWASP SECURITY HEADERS (ZERO-WARNING COMPLIANCE)
<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=*"
  Header always set Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';"
  Header unset X-Powered-By
  Header always unset X-Powered-By
  Header unset Server
</IfModule>

# 5. GZIP SPEED & BANDWIDTH OPTIMIZATION
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json application/xml
</IfModule>

# 6. BROWSER ASSET CACHING
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# 7. CUSTOM ERROR DOCUMENTS
ErrorDocument 404 /404.html
ErrorDocument 403 "403 Forbidden: Access Denied by Security Shield."
