# =============================================================================
# public/.htaccess — Apache / LiteSpeed (cPanel default)
#
# This file assumes the DOCUMENT ROOT points at public/. If you cannot change
# the document root on your host, see the root .htaccess instead — but be aware
# that leaving the project root web-accessible is what exposes .env.
# =============================================================================

<IfModule mod_rewrite.c>
  RewriteEngine On

  # If the app lives in a subdirectory, tell Apache which one. For
  # https://dghanalytics.com/aiseo/ this is /aiseo/public — adjust to match.
  # RewriteBase /aiseo/

  # Serve real files and directories untouched (CSS, JS, images).
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Everything else goes to the front controller.
  RewriteRule ^ index.php [L]
</IfModule>

# Never serve dotfiles, environment files, logs, backups or version control.
<FilesMatch "^\.|\.(env|ini|log|sql|sh|bak|orig|dist|lock|json|md|yml|yaml)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# Long cache for versioned assets — index.php appends ?v=<mtime>.
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css               "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/svg+xml          "access plus 1 year"
  ExpiresByType image/webp             "access plus 1 year"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  # This app is an internal tool: keep it out of every index, including AI
  # crawlers. Ironic for an SEO tool, and correct.
  Header always set X-Robots-Tag "noindex, nofollow, noarchive"
</IfModule>

# Directory listings off.
Options -Indexes

ErrorDocument 404 /index.php
