# ============================================================
#  AMNIYAT-E KOLLI-YE HOST (public_html)
# ============================================================

# Ghat'e namayesh-e list-e file-ha dar hame ja
Options -Indexes -MultiViews

# Hazf-e server signature
ServerSignature Off

# Khamush kardan-e namayesh-e khataha be karbar
# (in khotut faghat ru-ye mod_php kar mikonan, na PHP-FPM - hamun baraye hamin IfModule daran)
<IfModule mod_php.c>
    php_flag display_errors off
    php_flag expose_php off
</IfModule>

<IfModule mod_headers.c>
    Header always unset "X-Powered-By"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>

# Jelogiri az dastrasi be file-haye hassas/system - dar HAME-ye zir-pushe-ha
<FilesMatch "\.(sql|log|env|ini|bak|old|swp|git|yml|yaml|conf|config)$">
    Require all denied
</FilesMatch>

<FilesMatch "^(\.env|\.git|\.htpasswd|composer\.(json|lock)|package(-lock)?\.json|error_log)$">
    Require all denied
</FilesMatch>

# Jelogiri az dastrasi be pushe-haye .git / .svn (age jayi tuye host mundan)
RewriteEngine On
RewriteRule ^(.*/)?\.git/ - [F,L]
RewriteRule ^(.*/)?\.svn/ - [F,L]

# Majbur kardan be HTTPS baraye kolle domain
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Jelogiri az hotlink shodan-e aks-ha tavasote site-haye digar (ekhtiyari - agar mikhay ghairfa'al kon)
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteCond %{REQUEST_URI} \.(jpg|jpeg|png|gif|webp)$ [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp)$ - [F,L]

# Bastane dorb-haye ma'mul-e hamle (SQL injection / XSS dar query string)
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} union.*select.*\( [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code\( [NC]
RewriteRule .* - [F,L]