.htaccess

# ── Encoding & performance ────────────────────────────────────────────────────
AddDefaultCharset UTF-8
Options -Indexes

# ── Custom error pages ────────────────────────────────────────────────────────
ErrorDocument 404 /404.html
ErrorDocument 403 /404.html

# ── Trailing slash redirect (canonical URLs) ─────────────────────────────────
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !/$
RewriteRule ^(.*)$ /$1/ [R=301,L]

# ── Force HTTPS ───────────────────────────────────────────────────────────────
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ── www → non-www ─────────────────────────────────────────────────────────────
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

# ── Compression (Gzip) ───────────────────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json
  AddOutputFilterByType DEFLATE image/svg+xml text/xml
</IfModule>

# ── Browser caching ───────────────────────────────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html                 "access plus 1 hour"
  ExpiresByType text/css                  "access plus 1 month"
  ExpiresByType application/javascript    "access plus 1 month"
  ExpiresByType image/jpeg                "access plus 6 months"
  ExpiresByType image/png                 "access plus 6 months"
  ExpiresByType image/webp                "access plus 6 months"
  ExpiresByType image/svg+xml             "access plus 1 month"
  ExpiresByType application/json          "access plus 1 day"
  ExpiresByType text/xml                  "access plus 1 day"
</IfModule>

# ── Security headers ─────────────────────────────────────────────────────────
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# ── Protect sensitive files ───────────────────────────────────────────────────
<FilesMatch "(^\.htaccess|^\.env|^composer\.json|^package\.json)$">
  Order allow,deny
  Deny from all
</FilesMatch>