Options -Indexes

# --- CRITICAL SECURITY: Block access to .env and all hidden files ---
<FilesMatch "^\.">
    Require all denied
    Order allow,deny
    Deny from all
</FilesMatch>
# --------------------------------------------------------------------
RewriteEngine On

# Fail-safe: Block all hidden files using mod_rewrite just in case FilesMatch fails
RewriteRule (^\.|/\.) - [F,L]

# Redirect HTTP to HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Redirect WWW to Non-WWW
RewriteCond %{HTTP_HOST} ^www\.famgateway\.in [NC]
RewriteRule ^(.*)$ https://famgateway.in/$1 [L,R=301]

# Browser Caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/pdf "access plus 1 month"
  ExpiresByType text/x-javascript "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresDefault "access plus 2 days"
</IfModule>

# 301 Permanent Redirects for Legacy Underscore Filenames
RewriteRule ^payment_links\.php$ payment-links.php [R=301,L]
RewriteRule ^api_keys\.php$ api-keys.php [R=301,L]
RewriteRule ^admin/user_edit\.php$ admin/user-edit.php [R=301,L]
RewriteRule ^api/check_emails\.php$ api/check-emails.php [R=301,L]
RewriteRule ^api/check_emails_debug\.php$ api/check-emails-debug.php [R=301,L]
RewriteRule ^api/check_tmp\.php$ api/check-tmp.php [R=301,L]
RewriteRule ^api/manage_links\.php$ api/manage-links.php [R=301,L]
RewriteRule ^api/migrate_avatars\.php$ api/migrate-avatars.php [R=301,L]
RewriteRule ^api/migrate_db_column\.php$ api/migrate-db-column.php [R=301,L]
RewriteRule ^api/migrate_links\.php$ api/migrate-links.php [R=301,L]
RewriteRule ^api/qr_image\.php$ api/qr-image.php [R=301,L]
RewriteRule ^api/regenerate_key\.php$ api/regenerate-key.php [R=301,L]
RewriteRule ^api/verify_order\.php$ api/verify-order.php [R=301,L]

RewriteRule ^pay/([a-zA-Z0-9_-]+)$ pay.php?slug=$1 [L,QSA]
ErrorDocument 404 /404.php
ErrorDocument 403 /404.php

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>
<IfModule mod_security2.c>
  SecRuleEngine Off
</IfModule>
