Options -Indexes -MultiViews
ServerSignature Off
DirectoryIndex index.php
AddType application/manifest+json .webmanifest

# Plain error pages (no server banner / version).
ErrorDocument 400 "Bad request"
ErrorDocument 403 "Forbidden"
ErrorDocument 404 "Not found"
ErrorDocument 405 "Method not allowed"
ErrorDocument 500 "Server error"

# Only GET, HEAD and POST are used by this app.
<LimitExcept GET POST HEAD>
  Require all denied
</LimitExcept>

<IfModule mod_rewrite.c>
  RewriteEngine On
  # TRACE/TRACK are answered by Apache core unless rejected here (also set "TraceEnable Off" in httpd.conf).
  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|PUT|DELETE|PATCH|CONNECT)$ [NC]
  RewriteRule .* - [F,L]
</IfModule>

# Internal files are never served over HTTP.
<FilesMatch "^(config\.php|error_log|composer\.(json|lock)|package(-lock)?\.json)$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(md|sql|ps1|sh|bat|cmd|ini|log|env|dist|bak|old|orig|save|swp|swo|tmp|zip|tar|gz|7z|rar|xlsx|csv|json)$|~$">
  Require all denied
</FilesMatch>
# Dot-files and dot-directories (.git, .env, .impeccable, ...), except .well-known.
RedirectMatch 404 /\.(?!well-known/)
RedirectMatch 404 /(includes|database|tests|docs|design-system|node_modules|vendor)(/|$)
RedirectMatch 404 /admin/views(/|$)

<IfModule mod_headers.c>
  Header always unset X-Powered-By
  Header unset X-Powered-By
  # JS/CSS/fonts/images are always requested with ?v=<version>-<mtime>, so a new
  # upload changes the URL and clients fetch it immediately; old URLs can be
  # cached for a long time.
  <FilesMatch "\.(js|css|woff2|png|svg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
    Header set X-Content-Type-Options "nosniff"
    Header set Cross-Origin-Resource-Policy "same-origin"
  </FilesMatch>
  # The service worker must be revalidated on every visit so updates reach the field.
  <FilesMatch "^sw\.js$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
  <FilesMatch "\.svg$">
    Header set Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox"
  </FilesMatch>
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “alt-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-alt-php82___lsphp .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit