# ============================================================
# Pin PHP version to EA-PHP 8.2 (has PDO + pdo_mysql compiled in)
# MUST be at the top of the file.
# ============================================================
<IfModule mime_module>
    AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>

# ============================================================
# Directory hardening
# ============================================================
Options -Indexes
AddDefaultCharset UTF-8

<FilesMatch "(^\.env|^\.env\..*|^composer\.(json|lock)$|^\.git.*|.*\.(sql|log|md|sh|bak|old|ini|yml|yaml))$">
    Order allow,deny
    Deny from all
    Require all denied
</FilesMatch>

# ============================================================
# Block private dirs
# ============================================================
RewriteEngine On
RewriteRule ^(src|storage|vendor|app)(/.*)?$ - [F,L]

# ============================================================
# Force HTTPS
# ============================================================
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# ============================================================
# Security headers
# ============================================================
<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>