# === CONFIGURATION DE BASE ===
Options +FollowSymLinks
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
</IfModule>

AddDefaultCharset UTF-8

# === SÉCURITÉ : Bloquer les fichiers dangereux ===

# Bloquer les fichiers cachés (ex: .1713465498)
<IfModule mod_authz_core.c>
    # Apache 2.4+
    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    # Apache 2.2
    <FilesMatch "^\.">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Bloquer les fichiers sans extension (ex: Amemberlist)
<IfModule mod_authz_core.c>
    <FilesMatch "^[^\.]+$">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    <FilesMatch "^[^\.]+$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Bloquer les extensions dangereuses
<FilesMatch "\.(php|php3|php4|php5|php7|php8|phtml|phar|pl|py|cgi|sh|bat|exe|txt|log|env|sql|bak|old|zip|tar|gz|htaccess|htpasswd)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Désactiver PHP (si supporté)
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# === AUTORISER index.html et ressources statiques ===

<Files "index.html">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Allow from all
    </IfModule>
</Files>

<FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|webp|woff|woff2|ttf|eot|map|json|xml)$">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Allow from all
    </IfModule>
</FilesMatch>

# === REDIRECTIONS ===

<IfModule mod_rewrite.c>
    # Forcer HTTPS et www
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
    RewriteRule ^ https://www.%1%{REQUEST_URI} [L,NE,R=301]

    # Rediriger toutes les pages vers la racine
    RewriteCond %{REQUEST_URI} !^/$
    RewriteRule ^.*$ / [R=301,L]
</IfModule>