# CloseYourChallan — Apache configuration for cPanel shared hosting.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS. cPanel usually terminates TLS at the proxy, so check both.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Serve real files and directories directly (assets, installer).
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else goes to the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# Defence in depth: the security headers are also set in PHP, but if a static
# file is ever served directly these still apply.
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header unset X-Powered-By
</IfModule>

# No directory listings anywhere.
Options -Indexes

# Block access to anything that should never be fetched over HTTP, in case a
# deployment mistake ever places one of these inside the document root.
<FilesMatch "(^\.|composer\.(json|lock)|\.(sql|log|md|key|enc|ini|sh|bak|dist|yml|yaml)$|^config\.php$)">
    Require all denied
</FilesMatch>

# Uploaded content must never execute. This matters if a host refuses to let
# storage/ live outside public_html.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

ErrorDocument 403 /index.php
ErrorDocument 404 /index.php
