# =============================================================================
# OPTION A — package copied in AS-IS to its own folder (RECOMMENDED)
#
# Use this when the structure looks like:
#   public_html/aiseo-new/               <- you are here; this file is .htaccess
#   public_html/aiseo-new/bootstrap.php
#   public_html/aiseo-new/public/index.php
#   public_html/aiseo-new/src/
#   public_html/aiseo-new/templates/
#   ...
#
# INSTALL:
#   1. save this file as   public_html/aiseo-new/.htaccess
#   2. edit RewriteBase below to match your folder name
#   3. in .env set        APP_URL=https://dghanalytics.com/aiseo-new
#
# It forwards every request into public/ and hard-blocks everything else, so
# the source never becomes web-readable even though it sits under the web root.
# =============================================================================

<IfModule mod_rewrite.c>
  RewriteEngine On

  # MUST match the folder name, with leading and trailing slashes.
  RewriteBase /aiseo-new/

  # ---- hard blocks (before any forwarding) -------------------------------
  RewriteRule ^(\.env|\.git|\.htaccess|bootstrap\.php|preflight\.php|composer\.(json|lock)) - [F,L]
  RewriteRule ^(src|templates|config|bin|db|tests|var|storage|render-service|node_modules|vendor|deploy)(/|$) - [F,L]
  RewriteRule ^[0-9]+-[A-Za-z0-9_-]+(/|$) - [F,L]

  # ---- forward into public/ ----------------------------------------------
  # Already inside public/: let the inner public/.htaccess handle it.
  RewriteCond %{REQUEST_URI} ^.*/public/
  RewriteRule ^ - [L]

  # Real files and directories inside public/ are served untouched.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.*)$ public/$1 [L]

  # Everything else (including /) goes to the front controller.
  RewriteRule ^$ public/index.php [L]
  RewriteRule ^(.+)$ public/$1 [L]
</IfModule>

<FilesMatch "^\.env|\.(ini|log|sql|sh|bak|orig|dist|lock|yml|yaml)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Robots-Tag "noindex, nofollow, noarchive"
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

# If your host rejects this line with a 500, AllowOverride does not include
# Options. Delete just this line; everything else still works.
Options -Indexes