

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php84” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php84 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

# ============================================================================
# SECURITY HARDENING — North West Car Group garage system
# Added to stop sensitive files (logs, debug dumps, configs, backups, customer
# data) being served to the public web. Order matters; keep below the cPanel
# block above. Apache 2.4 syntax.
# ============================================================================

# 1. No directory listings anywhere.
Options -Indexes

# 2. Block all dotfiles (.htaccess, .ftpquota, .git, .env, etc.) — but keep
#    /.well-known/ reachable so SSL / domain validation still works.
RedirectMatch 404 /\.(?!well-known).*

# 3. Block log files, debug dumps, backups, configs and other sensitive types
#    by extension or name, wherever they live in the tree.
<FilesMatch "(?i)(^error_log$|\.(log|bak|bak\.php|old|orig|save|swp|sql|sqlite|db|ini|sh|env|inc|dist|sample|lock|map)$|.*debug.*\.(txt|log|php)$|.*_debug.*$|.*-debug.*$)">
    Require all denied
</FilesMatch>

# 4. Block the known debug / dump text files explicitly (belt and braces).
<FilesMatch "(?i)^(create_deal_debug\.txt|mot_debug\.txt|invite_debug\.log|twilio-inbound-debug\.log|notify\.log|garage_notify\.log)$">
    Require all denied
</FilesMatch>

# 5. Block source-leak duplicate files (backups / static exports of live pages).
<FilesMatch "(?i)^(dashboardok\.php|auction-analyser\.html)$">
    Require all denied
</FilesMatch>

# 6. Block direct browsing of internal directories. These hold code, secrets,
#    vendor libraries and customer artefacts that should only be reached
#    through the PHP app, never directly.
RedirectMatch 404 ^/(includes|vendor|logs|cgi-bin|webhooks|storage|email-attachments)/.*\.(log|txt|sql|md|json|lock|bak)$

# 7. Security response headers.
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "1; mode=block"
    # Uncomment once you have confirmed the whole app is served over HTTPS:
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# 8. Force HTTPS (recommended — uncomment after confirming the cert covers the host).
# <IfModule mod_rewrite.c>
#     RewriteEngine On
#     RewriteCond %{HTTPS} off
#     RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# </IfModule>
