

############################################################
# FINAL MAX-SECURITY + SPEED + HARDENED .htaccess
# For cPanel / Apache / Shared Hosting / Professional Sites
############################################################

###############################
# FORCE HTTPS
###############################
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


###############################
# SECURITY HEADERS
###############################
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header append Vary Accept-Encoding
</IfModule>


###############################
# BLOCK SENSITIVE FILES (.ENV, SQL, BACKUPS, CONFIG)
###############################
<FilesMatch "(\.env|\.env\.example|\.env\.bak|\.backup|\.bak|\.old|\.ini|\.sql|\.sh|\.log|\.zip|\.tar|\.gz|composer\.json|composer\.lock|package\.json|package-lock\.json)$">
    Require all denied
</FilesMatch>

# Block hidden files and system folders
RedirectMatch 404 (?i)(^|/)\.(git|svn|hg|idea|vscode)(/|$)

# Block access to ANY file beginning with a dot
<FilesMatch "^\.">
    Require all denied
</FilesMatch>


###############################
# DISABLE DIRECTORY BROWSING
###############################
Options -Indexes


###############################
# BLOCK PHP EXECUTION IN UPLOADS & STORAGE
###############################
<Directory "/home/*/public_html/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

<Directory "/home/*/public_html/storage">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>


###############################
# BLOCK COMMON ATTACK PATTERNS
###############################
# SQLi, LFI, RFI, base64, eval, traversal
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\|etc/passwd|wp-config\.php|eval\(|base64_) [NC]
RewriteRule .* - [F]

# Block uncommon PHP extensions probes
RewriteRule ^(.*/)?\.php[1-9]?$ - [F]


###############################
# BLOCK BAD BOTS & SCANNERS
###############################
SetEnvIfNoCase User-Agent "curl" bad_bot
SetEnvIfNoCase User-Agent "wget" bad_bot
SetEnvIfNoCase User-Agent "python" bad_bot
SetEnvIfNoCase User-Agent "nmap" bad_bot
SetEnvIfNoCase User-Agent "HTTrack" bad_bot

Order allow,deny
Allow from all
Deny from env=bad_bot


###############################
# SPEED OPTIMIZATION - BROWSER CACHING
###############################
<IfModule mod_expires.c>
    ExpiresActive On

    # Images
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"

    # CSS & JS
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"

    # Fonts
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/ttf "access plus 1 year"

    # HTML
    ExpiresByType text/html "access plus 1 hour"
</IfModule>


###############################
# GZIP COMPRESSION
###############################
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml text/css application/javascript application/json application/xml font/ttf font/otf
</IfModule>

FileETag None


###############################
# BLOCK KNOWN ATTACKER IPs (YOURS)
###############################
deny from 178.66.127.30
deny from 37.214.33.93
deny from 177.71.158.216
deny from 43.163.127.190
deny from 57.154.46.156


###############################
# ALLOW CUSTOM 403 PAGE
###############################
<Files 403.shtml>
    Order allow,deny
    Allow from all
</Files>


###############################
# CPANEL PHP HANDLER (DO NOT EDIT)

############################################################
# END OF FINAL HARDENED .htaccess

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php8_module>
   php_flag display_errors On
   php_value max_execution_time 900
   php_value max_input_time 1200
   php_value max_input_vars 1000
   php_value memory_limit 512M
   php_value post_max_size 8M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php82"
   php_value upload_max_filesize 2M
   php_flag zlib.output_compression On
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors On
   php_value max_execution_time 900
   php_value max_input_time 1200
   php_value max_input_vars 1000
   php_value memory_limit 512M
   php_value post_max_size 8M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php82"
   php_value upload_max_filesize 2M
   php_flag zlib.output_compression On
</IfModule>
# END cPanel-generated php ini directives, do not edit

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
