# Fortress CMS — Apache configuration
Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_mime.c>
    AddType image/svg+xml .svg
    AddType image/x-icon .ico
    AddType application/manifest+json .webmanifest
    AddType font/woff2 .woff2
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Keep /.well-known/security.txt reachable while blocking other dotfiles.
    RewriteCond %{REQUEST_URI} !/\.well-known/
    RewriteRule (^|/)\. - [F,L]

    # Private application directories (defence in depth; each also has its own .htaccess).
    RewriteRule ^(?:app|storage|plugins|docs|tests)(?:/|$) - [F,L]

    # Serve real public files (assets, install.php, index.php).
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]

    # Never browse directories.
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [F,L]

    # Everything else goes through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# Never expose source, configuration, databases, logs or manifests.
<FilesMatch "\.(?:md|json|lock|log|sql|db|sqlite|ini|dist|bak|sh|yml|yaml|neon)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
    Header always unset X-Powered-By
</IfModule>

# PHP settings are applied through .user.ini (works with PHP-FPM/CGI).
# Do not add php_value/php_flag here: they break on many FastCGI setups.
