Options -Indexes

# ── Local development — remove or comment these two lines before going to production


# ── Block HTTP TRACE method (prevents Cross-Site Tracing / XST attacks) ──────
# Note: definitive fix is TraceEnable off in httpd.conf
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
    RewriteRule .* - [F,L]
</IfModule>

# ── Security headers (belt-and-suspenders alongside Yii response component) ──
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    # HSTS — only effective over HTTPS; safe to set here as Apache strips it on plain HTTP
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    # Remove server fingerprinting headers
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# ── URL rewriting ────────────────────────────────────────────────────────────
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [L]
