# HM Pakistan — Apache 2.4 / cPanel production configuration
Options -Indexes -MultiViews
DirectoryIndex index.php
AddDefaultCharset UTF-8

ErrorDocument 404 /404/

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Preserve ACME validation and avoid HTTPS loops behind a cPanel proxy.
    RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ [NC]
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
    RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$ [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]

    # Existing files and directories are served directly.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Canonical trailing slashes for public GET routes; never redirect API POSTs.
    RewriteCond %{REQUEST_METHOD} =GET
    RewriteCond %{REQUEST_URI} !/$
    RewriteCond %{REQUEST_URI} !^/api/ [NC]
    RewriteRule ^(.+[^/])$ $1/ [R=301,L,NE]

    # Front controller for clean application routes and branded 404 responses.
    RewriteRule ^ index.php [L,QSA]
</IfModule>

# Never expose hidden files or common source/configuration artifacts.
<FilesMatch "(^\.|\.(?:env|ini|log|sql|bak|dist|md|yml|yaml|lock)$)">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" "expr=%{HTTPS} == 'on'"

    <FilesMatch "\.(?:avif|webp|png|jpe?g|gif|svg|ico|woff2|css|js)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    <FilesMatch "\.(?:php|html)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
    </FilesMatch>
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/avif "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_brotli.c>
    AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml
</IfModule>
