# Apache / cPanel. The private folders answer 403 to the outside world.
Options -Indexes
<FilesMatch "^(config\.local\.php|config\.sample\.php|DEPLOY\.md)$">
  Require all denied
</FilesMatch>
RewriteEngine On
RewriteRule ^(lib|data|tools)(/|$) - [F,L]
# HTTPS only: the app refuses plain http, and patients' invoice links must not travel in clear text.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Readable addresses. They do nothing until 'pretty_urls' => true is set in config.local.php,
# because every link the site prints is built by url() and follows that setting.
RewriteRule ^products/?$                 products.php [L,QSA]
RewriteRule ^products/([^/]+)/?$         product.php?slug=$1 [L,QSA]
RewriteRule ^categories/([^/]+)/?$       category.php?slug=$1 [L,QSA]
RewriteRule ^blog/?$                     blog.php [L,QSA]
RewriteRule ^blog/([^/]+)/?$             article.php?slug=$1 [L,QSA]
RewriteRule ^news/?$                     news.php [L,QSA]
RewriteRule ^news/([^/]+)/?$             news-item.php?slug=$1 [L,QSA]
RewriteRule ^about/?$                    about.php [L,QSA]
RewriteRule ^contact/?$                  contact.php [L,QSA]
RewriteRule ^search/?$                   search.php [L,QSA]
RewriteRule ^siaq/?$                     siaq.php [L,QSA]

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# nothing inside the upload folder may ever run
<Directory "uploads">
  php_flag engine off
</Directory>
