# OperaOS — .htaccess
# Segurança e roteamento para cPanel/Apache

Options -Indexes
Options -MultiViews

# Charset padrão
AddDefaultCharset UTF-8

# PHP 8.x
AddType application/x-httpd-php .php

# Proteger arquivos sensíveis
<FilesMatch "\.(sql|md|env|log|sh|bak)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Bloquear acesso direto a includes/
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Bloquear acesso direto a /includes/
    RewriteRule ^includes/ - [F,L]

    # Redirecionar raiz para index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^$ /index.php [L]
</IfModule>

# Headers de segurança
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Gzip para performance
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript
</IfModule>

# Cache de assets estáticos
<FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2)$">
    Header set Cache-Control "max-age=2592000, public"
</FilesMatch>
