# AAG Portal v2 — Root security hardening

# No directory browsing anywhere in this app
Options -Indexes

# Never let config/, includes/, logs/ be requested directly by URL,
# even though config.php etc. don't output anything themselves.
<FilesMatch "\.(sql|log|env|md)$">
    Require all denied
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; script-src 'self' https://cdn.jsdelivr.net https://www.google.com https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; frame-src https://www.google.com;"
</IfModule>

# Hide PHP version / server signature where the host allows it
ServerSignature Off

# Block common bot/scanner user agents from even reaching PHP
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python-requests|scrapy|curl/7) [NC]
    RewriteRule .* - [F,L]
</IfModule>
