# ═══════════════════════════════════════════════════════════════
#  ELEGANCE OF INDIA — MASTER SECURITY .htaccess
#  Root directory — c:/xampppo/htdocs/eleganceofindia/
# ═══════════════════════════════════════════════════════════════

# ── 1. Disable Directory Browsing ───────────────────────────────
Options -Indexes -ExecCGI
ServerSignature Off

# ── 2. Security HTTP Headers ────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options     "nosniff"
    Header always set X-Frame-Options            "SAMEORIGIN"
    Header always set X-XSS-Protection           "1; mode=block"
    Header always set Referrer-Policy            "strict-origin-when-cross-origin"
    Header always set Permissions-Policy         "geolocation=(), microphone=(), camera=()"
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# ── 3. Hide PHP version ─────────────────────────────────────────
<IfModule mod_php.c>
    php_flag expose_php Off
    php_flag display_errors Off
    php_flag display_startup_errors Off
    php_flag log_errors On
</IfModule>

# ── 4. Block ALL Sensitive / Dev Files ──────────────────────────
<FilesMatch "(\.htaccess|\.htpasswd|\.env|\.git|\.svn|\.log|\.bak|\.sql|\.sh|\.lock|\.cfg|\.conf|composer\.(json|lock)|README|LICENSE|CHANGELOG)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ── 5. Block the admin ZIP — CRITICAL ───────────────────────────
<Files "admin-panal.zip">
    Order deny,allow
    Deny from all
</Files>

# ── 6. Block config.php from direct access ──────────────────────
<Files "config.php">
    Order deny,allow
    Deny from all
</Files>

# ── 7. Enable Rewrite Engine ────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /eleganceofindia/

    # ── 7a. Force HTTPS (uncomment on Hostinger live server) ──
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # ── 7b. Block PHP in upload directories ───────────────────
    RewriteRule ^assets/.*\.(php|php\d|phtml|phar|pl|py|sh|cgi|asp|aspx)$ - [F,NC,L]
    RewriteRule ^tmp/.*\.(php|php\d|phtml|phar)$ - [F,NC,L]

    # ── 7c. Block malicious SQL injection in query string ─────
    RewriteCond %{QUERY_STRING} (union.*select|select.*from|insert.*into|drop.*table|update.*set|delete.*from|load_file|outfile) [NC,OR]
    RewriteCond %{QUERY_STRING} (exec|passthru|shell_exec|system|popen|proc_open|eval)\s*\( [NC,OR]
    RewriteCond %{QUERY_STRING} (base64_encode|base64_decode|gzinflate|gzdeflate|str_rot13)\s*\( [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/) [NC,OR]
    RewriteCond %{QUERY_STRING} (javascript:|vbscript:|data:text) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
    RewriteRule .* - [F,L]

    # ── 7d. Block bad bots and vulnerability scanners ─────────
    RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|nmap|masscan|acunetix|nessus|dirbuster|havij|w3af|skipfish|burpsuite|zgrab|nuclei|wfuzz|gobuster|feroxbuster) [NC]
    RewriteRule .* - [F,L]

    # ── 7e. Block common WordPress/CMS exploit paths ──────────
    RewriteCond %{REQUEST_URI} (wp-admin|wp-login|wp-config|xmlrpc|\.git/|\.svn/|phpmyadmin|adminer|phpinfo) [NC]
    RewriteRule .* - [F,L]

    # ── 7f. Block file upload exploits via HTTP method ────────
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|DELETE|PUT) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# ── 8. Limit Upload & Execution Time ────────────────────────────
<IfModule mod_php.c>
    php_value upload_max_filesize    10M
    php_value post_max_size          12M
    php_value max_execution_time     60
    php_value max_input_time         60
    php_value memory_limit           256M
    php_flag  allow_url_fopen        Off
    php_flag  allow_url_include      Off
</IfModule>

# ── 9. Hotlinking Protection (Disabled for debugging) ──────────
# <IfModule mod_rewrite.c>
#     RewriteCond %{HTTP_REFERER} !^$
#     RewriteCond %{HTTP_REFERER} !^https?://(localhost|127\.0\.0\.1|(www\.)?eleganceofindia\.) [NC]
#     RewriteRule \.(jpg|jpeg|png|gif|webp|svg|mp4|webm)$ - [F,NC,L]
# </IfModule>