# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

# ============================================================
# SECURITY RULES — Added to block backdoors & sensitive files
# ============================================================

# Block direct access to log, txt, lock files
<FilesMatch "\.(log|lock|txt|json|sql|bak|backup|sh|env)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Allow data.json if needed by app (remove this if not needed)
<Files "data.json">
    Order allow,deny
    Deny from all
</Files>

# Block access to hidden files (.htpasswd, .env, etc.)
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>
# Allow .htaccess itself
<Files ".htaccess">
    Order allow,deny
    Allow from all
</Files>

# Block access to h5kservice admin panel from outside (optional — uncomment if needed)
# <Files "admin.php">
#     Order deny,allow
#     Deny from all
#     Allow from YOUR_IP_ADDRESS
# </Files>

# Disable directory listing
Options -Indexes

# Security Headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Block access to debug.txt specifically
<Files "debug.txt">
    Order allow,deny
    Deny from all
</Files>
