# Encrypt CMS - Apache Web Server Configuration
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    # RewriteBase omitted to support both root domain and subdirectory installations
    # RewriteBase /

    # Block direct access to sensitive internal directories
    RewriteRule ^(config|database|app|templates)/ - [F,L,NC]
    RewriteRule ^storage/(framework|logs|backups)/ - [F,L,NC]
    RewriteRule ^storage/[^/]+\.(json|lock|key|php)$ - [F,L,NC]
    RewriteRule ^storage/uploads/.*(?i:\.(php[0-9]?|phtml|phtm|phar|phps|cgi|pl|exe|sh|py|rb|asp|aspx|shtml|inc|hphp))$ - [F,L]
    RewriteRule ^(themes|plugins)/.*(?i:\.(php[0-9]?|phtml|phtm|phar|phps|inc|hphp))$ - [F,L]

    # Block access to hidden files/directories (except .well-known)
    RewriteCond %{REQUEST_URI} "!(^|/)\.well-known([^/]+)?/" [NC]
    RewriteRule "(^|/)\." - [F]

    # If the requested file or directory exists physically, serve it directly
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Otherwise route everything to the front controller
    RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

# Prevent directory browsing
Options -Indexes

# Security headers where mod_headers is available
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
