# CF Panel — Apache Security Configuration

# Deny direct access to sensitive files
<FilesMatch "(config\.php|bootstrap\.php|schema\.sql|\.json|license_history\.json)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Deny access to includes directory
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to includes
    RewriteRule ^includes/ - [F,L]

    # Redirect to HTTPS (uncomment if you have SSL)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Disable directory listing
Options -Indexes

# Block common attack patterns
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%252e%252e%252f) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# PHP security settings
# NOTE: php_flag/php_value only work when PHP runs as an Apache module (mod_php).
# On PHP-FPM, LiteSpeed, CGI or FastCGI these directives cause an HTTP 500, so
# they are guarded. If your host uses PHP-FPM, set these in php.ini / .user.ini.
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value upload_max_filesize 2M
    php_value max_file_uploads 5
</IfModule>
<IfModule mod_php7.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value upload_max_filesize 2M
    php_value max_file_uploads 5
</IfModule>
