# ZAYN Store - root .htaccess
Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
  RewriteEngine On

  # ---- Hide .php extension everywhere on the site ----
  # 1) If someone requests a URL that still ends in .php, send a permanent
  #    redirect to the clean (extension-less) address so the .php name never
  #    stays visible in the address bar, even if an old link is followed.
  #    Restricted to GET/HEAD only: a 301 on a POST request can make some
  #    browsers resend it as GET and drop the form body, so POSTs made
  #    directly to an existing .php action (e.g. <form action="cart.php">)
  #    are left alone and simply served as-is.
  RewriteCond %{REQUEST_METHOD} ^(GET|HEAD)$
  RewriteCond %{THE_REQUEST} \s/+([^?\s]+?)\.php[\s?] [NC]
  RewriteRule ^ /%1 [R=301,L]

  # 2) Internally serve the real .php file when a clean URL is requested,
  #    without ever exposing the .php name to the visitor.
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}\.php -f
  RewriteRule ^(.*)$ $1.php [L,QSA]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set X-Permitted-Cross-Domain-Policies "none"
  Header set Permissions-Policy "geolocation=(self), camera=(), microphone=(), payment=(self)"
  Header set Cross-Origin-Opener-Policy "same-origin"
  # Loosened enough to allow the fonts/scripts already used by the theme
  # (Font Awesome + jsDelivr for Sortable.js) without breaking the site.
  Header set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; font-src 'self' https://cdnjs.cloudflare.com data:; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://unpkg.com; connect-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
  <IfModule mod_ssl.c>
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
  </IfModule>
</IfModule>

# Block dangerous / noisy HTTP methods
<IfModule mod_rewrite.c>
  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|CONNECT)$
  RewriteRule .* - [F,L]
</IfModule>

# Block access to sensitive files, backups and version-control leftovers
<FilesMatch "\.(sql|log|md|env|bak|old|zip|rar|7z|tar|gz|sh|ini|conf|swp|orig)$">
  Require all denied
</FilesMatch>
<FilesMatch "^\.(git|gitignore|gitattributes|htpasswd)">
  Require all denied
</FilesMatch>
<DirectoryMatch "^.*/\.git/.*$">
  Require all denied
</DirectoryMatch>
