# =====================================================
# SECURE .HTACCESS FOR ETONBANK.COM (Laravel)
# SECURE .HTACCESS FOR loydisbanksgroups.co (Laravel)
# =====================================================
# ---------------------------------------------------

[13 lines collapsed]

# 3. SECURITY HEADERS
# ---------------------------------------------------
<IfModule mod_headers.c>
    # Prevent MIME type sniffing
    Header set X-Content-Type-Options "nosniff"
    
    # Prevent clickjacking
    Header set X-Frame-Options "SAMEORIGIN"
    
    # XSS Protection
    Header set X-XSS-Protection "1; mode=block"
    
    # Referrer Policy
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    
    # Force HTTPS (if you have SSL)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
    # Remove PHP version exposure
    Header unset X-Powered-By
    # Enable HSTS only when HTTPS is active
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>
# ---------------------------------------------------

[18 lines collapsed]

</FilesMatch>
# ---------------------------------------------------
# 7. LARAVEL ROUTING (Your Original Rules)
# 7. LARAVEL ROUTING + STATIC FILES
# ---------------------------------------------------
<IfModule mod_rewrite.c>

[2 lines collapsed]

    </IfModule>
    RewriteEngine On
    RewriteBase /
    # Block PHP files in sensitive directories
    # Force HTTPS (enable after SSL certificate is installed)
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    # Always allow site images and static assets (logo, css, js, uploads)
    RewriteCond %{REQUEST_URI} ^/(assets|storage)/ [NC]
    RewriteRule .* - [L]
    # Block PHP files in public asset directories
    RewriteCond %{REQUEST_URI} (uploads|assets|storage|images|css|js)/.*\.php$ [NC]
    RewriteRule .* - [F,L]
    # Block access to hidden files (except .well-known)
    RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+\./?)+$" [NC]
    RewriteCond %{SCRIPT_FILENAME} -d [OR]
    RewriteCond %{SCRIPT_FILENAME} -f
    RewriteRule "(^|/)\." - [F,L]
    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    # Redirect Trailing Slashes If Not A Folder...
    # Redirect trailing slashes
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]
    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    # Serve existing files/directories directly (images, css, js, fonts)
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule .* - [L]
    # Send everything else to Laravel
    RewriteRule ^ index.php [L]
</IfModule>
# ---------------------------------------------------
# 8. BLOCK COMMON ATTACK PATTERNS
# ---------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (eval\(|base64_|gzinflate|shell_exec|passthru|system\() [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
    RewriteRule .* - [F,L]
</IfModule>
# ---------------------------------------------------
# 9. FORCE HTTPS (if you have SSL certificate)
# 9. HOTLINK PROTECTION (optional - never blocks /assets/ or /storage/)
# ---------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
    RewriteEngine On
# ---------------------------------------------------
# 10. PROTECT AGAINST HOTLINKING (allows current domain)
# ---------------------------------------------------
<IfModule mod_rewrite.c>
    # Skip hotlink check for site-owned folders
    RewriteCond %{REQUEST_URI} ^/(assets|storage)/ [NC]
    RewriteRule .* - [L]
    # Allow this domain (with or without www)
    RewriteCond %{HTTP_REFERER} ^https?://(www\.)?loydisbanksgroups\.co [NC,OR]
    RewriteCond %{HTTP_REFERER} ^https?://(www\.)?%{HTTP_HOST} [NC,OR]
    RewriteCond %{HTTP_REFERER} ^$
    RewriteRule \.(jpg|jpeg|png|gif|svg|webp|ico)$ - [L]
    # Block hotlinked images from other websites only
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?loydisbanksgroups\.co [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?%{HTTP_HOST} [NC]
    RewriteRule \.(jpg|jpeg|png|gif|svg|webp)$ - [F,NC,L]
    RewriteRule \.(jpg|jpeg|png|gif|svg|webp|ico)$ - [F,NC,L]
</IfModule>
# END OF SECURE .HTACCESS
# END OF .HTACCESS