ErrorDocument 404 /404.php

# Enable Rewrite Engine
RewriteEngine On
Options -Indexes

# ============================================================
# 0. SENSITIVE FILES & DIRECTORY PROTECTION
# ============================================================
<FilesMatch "(^\.|\.(env|log|sql|bak|config|sh|inc|git|sqlite|yml|yaml))$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block malicious query strings & common SQLi/XSS attack vectors
RewriteCond %{QUERY_STRING} (eval\(|union.*select|base64_decode|concat\(|<script|<iframe) [NC]
RewriteRule .* - [F,L]

# Redirect /index.php or /index to /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s/index\.php [NC]
RewriteRule ^index\.php$ / [R=301,L]

# Redirect direct .php requests to extensionless URLs (excluding index.php)
RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s/([^.]+)\.php [NC]
RewriteRule ^ %1 [R=301,L]

# Internally rewrite clean URLs to PHP files
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([^/]+)/?$ $1.php [L]

# ============================================================
# 1. GZIP / DEFLATE COMPRESSION (BOOST PAGESPEED SCORE)
# ============================================================
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml application/xml+rss
    AddOutputFilterByType DEFLATE font/woff font/woff2 application/font-woff2
</IfModule>

# ============================================================
# 2. BROWSER CACHING & EXPIRES HEADERS (1-YEAR ASSET CACHE)
# ============================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"
    
    # Images & WebP
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    
    # Fonts
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType application/font-woff2 "access plus 1 year"
    
    # CSS & JavaScript
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
</IfModule>

# ============================================================
# 3. HTTP SECURITY, AI AGENT ALLOWLIST & CDN VARY HEADERS
# ============================================================
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set X-XSS-Protection "1; mode=block"
    Header set Permissions-Policy "geolocation=(self), camera=(), microphone=()"
    Header append Vary "Accept, Accept-Encoding, User-Agent"

    # Explicit Allowlist Headers for AI Search Engines & Agents
    SetEnvIfNoCase User-Agent "(GPTBot|ChatGPT-User|OAI-SearchBot|ClaudeBot|Claude-Web|anthropic-ai|Google-Extended|Googlebot|DeepSeekBot|PerplexityBot|Applebot|Applebot-Extended|Meta-ExternalAgent|Amazonbot|Cohere-ai|MistralBot|Bytespider)" IS_AI_AGENT
    Header set X-Robots-Tag "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1" env=IS_AI_AGENT
    Header set X-Agent-Allowed "true" env=IS_AI_AGENT
</IfModule>
