# cPanel Admin Panel — Apache config
# Path: admin/admin/.htaccess

# Allow access to public assets & API endpoints
# Block direct access to PHP includes and config files

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Allow direct access to API endpoints (no auth required for get-config.php)
  # Block direct access to inc/ folder
  RewriteRule ^inc/ - [F,L]
</IfModule>

# Block access to config JSON directly (force API endpoint)
<FilesMatch "\.(json)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# Allow public access to get-config.php only
<Files "get-config.php">
  Order allow,deny
  Allow from all
</Files>

# Disable directory listing
Options -Indexes

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Compress text-based assets
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json
</IfModule>

# Cache static assets
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/svg+xml "access plus 30 days"
</IfModule>
