# ============================================================
#  AMNIYAT-E RABAT-E UPLOADER
# ============================================================

# Ghat'e namayesh-e list-e file-ha
Options -Indexes -MultiViews

# Hazf-e server signature va etela'at-e ezafi
ServerSignature Off

<IfModule mod_headers.c>
    Header always unset "X-Powered-By"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer-when-downgrade"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Bastane method-haye khatarnak-e HTTP (TRACE/TRACK baraye jelogiri az XST attack)
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Fesharde-sazi (gzip) baraye sor'at-e bishtar (bishtar ru-ye safhat-e admin/HTML tasir dare)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/plain text/xml application/json application/javascript
</IfModule>

# Cache-e browser baraye file-haye sabet (CSS) - sor'at-e panel-e vebi ro bala mibare
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 week"
</IfModule>

# Khamush kardan-e namayesh-e khataha (etela'at hassas leak nashe birun)
# (in khotut faghat ru-ye mod_php kar mikonan, na PHP-FPM - hamun baraye hamin IfModule daran)
<IfModule mod_php.c>
    php_flag display_errors off
    php_flag expose_php off
</IfModule>

# Jelogiri az dastrasi-ye mostaghim be file-haye hassas (az har koja tuye in pushe)
<FilesMatch "\.(sql|md|log|env|ini|bak|zip|gz|tar|git|yml|yaml)$">
    Require all denied
</FilesMatch>

# Jelogiri az dastrasi be file-haye pichide/ezafi
<FilesMatch "^(composer\.(json|lock)|\.gitignore|\.gitattributes|error_log|\.htpasswd)$">
    Require all denied
</FilesMatch>

# Jelogiri-ye mostaghim az pushe-haye includes (har ja tuye project bashan)
RewriteEngine On
RewriteRule ^(.*/)?includes/ - [F,L]

# Majbur kardan be HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]