# ── HTTPS Redirect ──────────────────────────────────────────────────────────
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ── Security Headers ─────────────────────────────────────────────────────────
# HSTS: tell browsers to always use HTTPS (1 year). Add "; preload" and submit
# to https://hstspreload.org once you're confident HTTPS is permanent.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

# Prevent MIME-type sniffing
Header always set X-Content-Type-Options "nosniff"

# Block this site from being embedded in iframes
Header always set X-Frame-Options "DENY"

# Control how much referrer info is sent to external sites
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Disable browser features not used by this site
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()"

# Prevent cross-origin window attacks
Header always set Cross-Origin-Opener-Policy "same-origin"

# Restrict cross-origin resource loading
Header always set Cross-Origin-Resource-Policy "same-origin"

# Content Security Policy
# - script/style 'unsafe-inline' required for inline blocks in both pages
# - fonts.googleapis.com for Google Fonts CSS; fonts.gstatic.com for font files
# - ki5bhv.com for the profile photo
Header always set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests"

# ── Strip Server Info ─────────────────────────────────────────────────────────
Header always unset X-Powered-By
Header always unset Server

# ── security.txt: also serve from /.well-known/ per RFC 9116 ─────────────────
RedirectMatch 301 ^/.well-known/security.txt$ /security.txt

# ── Sitemap ───────────────────────────────────────────────────────────────────
# Declared here so crawlers that read robots.txt can find it
# (also declared in robots.txt if you add one)

# ── Disable directory listing ─────────────────────────────────────────────────
Options -Indexes

# ── Protect dotfiles ──────────────────────────────────────────────────────────
<FilesMatch "^\.">
  Require all denied
</FilesMatch>