php_value max_input_vars 1000000000

# Secure .env file
<Files ".env">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

# Block sensitive files
<FilesMatch "\.(sql|log|md|env|bak|old|orig|ini|sh|bat|py)$">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block debug/diagnostic files
<FilesMatch "^(temp_diag|test_connection|phpinfo|info|debug)\.php$">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block .git directory
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^\.git/ - [F,L]
</IfModule>

# Cluster internals — included from PHP only, never served over HTTP.
# (health.php stays public so load balancers can probe it.)
<FilesMatch "^(worker|session_boot|load_env)\.php$">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
<FilesMatch "^Cluster\.php$">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), usb=(), payment=()"
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Resource-Policy "same-origin"

    # Never cache service workers
    <FilesMatch "sw.*\.js$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>

    # Never cache the main script (avoids stale AJAX form logic)
    <FilesMatch "^main\.js$">
        Header set Cache-Control "no-cache, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>

    # Never cache PHP files
    <FilesMatch "\.php$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>

    # Never cache manifest
    <FilesMatch "manifest\.json$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>
</IfModule>
