Gecko [ re-designstudio.net ]

Name	Size	Permission	Date	Action
.htaccess	4.98 KB	-rw-r--r--	2026-08-11 08:29

Rename

# =============================================================
# Alpha Design & Networking — public/.htaccess
# Apache config for cPanel shared hosting (mod_rewrite, mod_headers,
# mod_deflate, mod_expires — all standard on cPanel's Apache/EA-Apache).
# =============================================================

# ---- 1. Directory browsing & indexes ----
Options -Indexes -MultiViews
Options +FollowSymLinks

# ---- 2. Force HTTPS + canonical host (non-www) ----
# cPanel usually issues a free AutoSSL cert; this assumes HTTPS is available.
# If the client wants "www.alphadnet.net" canonical instead, swap the two
# RewriteCond lines below (flip which one has the "!").
RewriteEngine On
# Skip the forced-HTTPS/canonical-host rules for local Docker testing
# (no TLS listener on localhost:8080) — never matches the real domain.
RewriteCond %{HTTP_HOST} !^localhost(:\d+)?$
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteCond %{HTTP_HOST} !^localhost(:\d+)?$
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# ---- 3. Block direct access to sensitive files & folders ----
# Partials in includes/ must only ever be reached via PHP `include`,
# never requested directly as a URL.
RewriteRule ^includes/ - [F,L]

<FilesMatch "\.(md|yml|yaml|lock|log|sql|sh|bak|swp|orig|save|old|tmp)$|~$">
    Require all denied
</FilesMatch>

# Dotfiles (.git, .env, .DS_Store, this .htaccess itself, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# config.php / any *.local.php holding constants — belt-and-braces on top
# of the includes/ block above, in case config ever moves.
<FilesMatch "^config\.php$|\.local\.php$">
    Require all denied
</FilesMatch>

# ---- 4. Never execute scripts inside the image/asset folders ----
# Defense-in-depth in case a future upload feature (or a compromised
# FTP/cPanel credential) lands a disguised script in assets/img — this is
# the single most common way small business sites get "hacked" and have
# malicious content silently embedded. Uses mod_rewrite (not <If>+
# <FilesMatch> nesting, which proved unreliable in testing, and not
# <IfModule mod_php.c>, which never runs at all under PHP-FPM/suPHP —
# common on current cPanel plans) so it's enforced at the Apache
# access-control level regardless of PHP handler.
RewriteCond %{REQUEST_URI} ^/assets/ [NC]
RewriteCond %{REQUEST_URI} \.(php[3457]?|phtml|pht|cgi|pl|py|exe|sh)$ [NC]
RewriteRule ^ - [F,L]

# ---- 5. Security headers ----
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set X-XSS-Protection "1; mode=block"
    # frame-src/child-src 'none' + object-src 'none' block the two classic
    # "malicious content got embedded" vectors (injected iframes and
    # plugin/Flash-style objects); connect-src 'self' stops any script that
    # did get in from phoning data out. Tighten style-src further if
    # main.js's inline needs ever go away.
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; form-action 'self'; frame-src 'none'; child-src 'none'; frame-ancestors 'self'; base-uri 'self'; object-src 'none'"
    Header unset X-Powered-By
</IfModule>
<IfModule mod_php.c>
    php_flag expose_php off
</IfModule>
ServerSignature Off

# ---- 6. Block risky HTTP methods (XST etc.) ----
<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

# ---- 7. Compression ----
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# ---- 8. Caching for static assets ----
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
</IfModule>

# ---- 9. Unmatched routes ----
# Any request that isn't an existing file or directory (old bookmarked
# URLs, typos, stale links from the previous site) redirects to the
# homepage instead of a raw Apache 404. QSD drops the original query
# string so the redirect target is always a clean /index.php.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ /index.php [R=302,L,QSD]

# ---- 10. Custom error pages ----
# Only reachable for errors Apache raises itself (500s, etc.) — rule 9
# above already routes missing-file 404s to the homepage.
# Enable once error-500.php exists in public/:
# ErrorDocument 500 /error-500.php