# ACC Engine — production hardening (Apache / LiteSpeed / cPanel)
Options -Indexes
ServerSignature Off

# Deny hidden / VCS / env
<IfModule mod_authz_core.c>
  <FilesMatch "^\.">
    Require all denied
  </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
  <FilesMatch "^\.">
    Order allow,deny
    Deny from all
  </FilesMatch>
</IfModule>

# Block installer / seed / temp / dump scripts from the web
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block common attack probes
  RewriteRule (^|/)\.(git|svn|env|htpasswd) - [F,L]

  # Operational scripts must never be public
  RewriteRule (^|/)(run[-_].*\.php)$ - [F,L]
  RewriteRule (^|/)(_tmp_.*\.php)$ - [F,L]
  RewriteRule (^|/)(reset-db.*\.php)$ - [F,L]
  RewriteRule (^|/)(db-test\.php)$ - [F,L]
  RewriteRule (^|/)(.*\.(sql|sql\.gz|rar|7z|bak|old|dist))$ - [F,L]

  # Sensitive directories (also have local Deny .htaccess)
  RewriteRule ^(standalone|storage|logs|includes|acc-jwt|docs|\.claude|\.git)(/|$) - [F,L]

  # Force HTTPS on production — uncomment after SSL is active:
  # RewriteCond %{HTTPS} !=on
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Security headers (complement PHP headers)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always unset X-Powered-By
  Header unset X-Powered-By
  # HSTS — enable only over HTTPS
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

# Limit request methods for static assets quietly; PHP handles API verbs
<IfModule mod_rewrite.c>
  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)$
  RewriteRule .* - [F,L]
</IfModule>

# PHP flags when allowed (cPanel / LiteSpeed)
<IfModule mod_php.c>
  php_flag expose_php Off
  php_flag display_errors Off
  php_flag allow_url_include Off
</IfModule>
<IfModule lsapi_module>
  php_flag expose_php Off
  php_flag display_errors Off
  php_flag allow_url_include Off
</IfModule>
