# ═══════════════════════════════════════════════════════
# MAG SYS — Root-level Security
# ═══════════════════════════════════════════════════════

# ── Disable directory listing ──
Options -Indexes

# ── Block sensitive files at any level ──
<FilesMatch "\.(env|log|sql|sql\.gz|bak|backup|conf|cfg|ini|md|json|lock|yml|yaml|gitignore)$">
    <RequireAll>
        Require all denied
    </RequireAll>
    Order deny,allow
    Deny from all
</FilesMatch>

# ── Block hidden files (.git, .htaccess, .env, etc.) ──
<FilesMatch "^\.">
    <RequireAll>
        Require all denied
    </RequireAll>
    Order deny,allow
    Deny from all
</FilesMatch>

# ── Block common attack patterns ──
RewriteEngine On

# Block direct access to includes folder
RewriteRule ^includes/?(.*)$ - [F,L]

# Block direct access to backup files
RewriteRule \.(sql|sql\.gz|bak|backup|log|env)$ - [F,L,NC]

# Block URL injection attempts
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} (\.\./){2,} [OR]
RewriteCond %{QUERY_STRING} (eval|base64_decode|gzinflate|str_rot13)\( [NC]
RewriteRule ^(.*)$ - [F,L]

# ── Force HTTPS ──
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ── Security headers ──
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header set Permissions-Policy "geolocation=(self), microphone=(), camera=()"
</IfModule>

# ── Disable server signature ──
ServerSignature Off

# ── PHP error suppression in production ──
php_flag display_errors Off
php_flag log_errors On
