# ===== SIPAJAR v3 — Pengerasan Keamanan =====
Options -Indexes -MultiViews

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Paksa HTTPS (aktif bila sertifikat sudah terpasang)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{HTTP_HOST} !^localhost
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Blokir metode HTTP yang tidak dipakai
  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|DEBUG|CONNECT)
  RewriteRule .* - [F,L]

  # Blokir pola serangan umum pada query string
  RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|union[\s+]+select|base64_decode\(|<script|%3Cscript|php://|file://|etc/passwd) [NC]
  RewriteRule .* - [F,L]
</IfModule>

# Header keamanan (juga diset dari PHP sebagai lapisan kedua)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
  Header always unset X-Powered-By
  Header always unset Server
  Header set Cache-Control "no-store, no-cache, must-revalidate" env=NO_CACHE
</IfModule>

# Lindungi berkas sensitif
<FilesMatch "^(config\.php|config\.sample\.php|\.env|.*\.sql|.*\.md|composer\.(json|lock)|\.htaccess|\.gitignore)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# Cegah eksekusi skrip di folder unggahan
<IfModule mod_php.c>
  php_flag display_errors off
  php_flag log_errors on
  php_flag expose_php off
  php_value session.cookie_httponly 1
  php_value session.use_strict_mode 1
</IfModule>

# Kompresi & cache aset statis
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript text/plain application/json
</IfModule>
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/jpeg "access plus 30 days"
</IfModule>

ErrorDocument 403 /index.php
ErrorDocument 404 /index.php
