# 🛡️ ZA-FARM-KH Security Rules

# បិទមិនឲ្យគេមើលឃើញបញ្ជីឯកសារនៅក្នុង Folder (Directory Indexing)
Options -Indexes

# បិទ Server Signature
ServerSignature Off

# បិទមិនឲ្យគេចូលមើលឯកសារសំខាន់ៗ
<FilesMatch "^\.env|\.git|config\.php|db\.js|\.htaccess|\.htpasswd|package\.json|package-lock\.json|\.log$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to backup files
<FilesMatch "\.(bak|sql|swp|old|tmp|orig)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to source maps
<FilesMatch "\.map$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security Headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"
    Header set X-XSS-Protection "0"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()"
    Header set X-Download-Options "noopen"
    Header set X-Permitted-Cross-Domain-Policies "none"
    # HSTS (enable only if using HTTPS)
    # Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
</IfModule>

# Prevent viewing source of PHP files
<IfModule mod_php.c>
    php_flag display_errors off
    php_flag expose_php off
</IfModule>

# Block common attack bots
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # 🚫 BYPASS Passenger/Express for PHP api & API directories
    RewriteCond %{REQUEST_URI} ^/(api|API) [NC]
    RewriteRule .* - [L]
    
    # Block access to hidden files/directories
    RewriteRule (^\.|/\.) - [F]
    
    # Block common exploit paths
    RewriteRule ^(wp-admin|wp-login|administrator|phpmyadmin) - [F]
    
    # 🔗 Clean URLs — remove .html extension
    # If the request doesn't have an extension and a matching .html file exists, serve it
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME}.html -f
    RewriteRule ^(.+)$ $1.html [L]

    # 🔗 Redirect .html URLs to clean URLs (optional SEO — 301 redirect)
    RewriteCond %{THE_REQUEST} \s/(.+?)\.html[\s?] [NC]
    RewriteRule ^ /%1 [R=301,L]
    
    # Force HTTPS (uncomment when SSL is ready)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
