# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit


# =========================================
# Bodhuboron Jewellery ERP Security Lock
# Test ERP Root
# =========================================

# Folder listing বন্ধ
Options -Indexes


# -----------------------------------------
# Block sensitive PHP configuration files
# -----------------------------------------

<FilesMatch "^(config|db|database|connection|conn|env|settings|session|response)\.php$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>

  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>


# -----------------------------------------
# Block database, backup, archive and log files
# -----------------------------------------

<FilesMatch "\.(sql|zip|gz|tar|tgz|bak|backup|old|log|ini|env|sh)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>

  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>


# -----------------------------------------
# Block files containing backup indicators
# -----------------------------------------

<FilesMatch "(_old|_backup|_bak)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>

  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>


# -----------------------------------------
# Block private/internal folders
# -----------------------------------------

<IfModule mod_rewrite.c>
  RewriteEngine On

  RewriteRule (^|/)_old_junk[^/]*(/|$) - [F,L,NC]
  RewriteRule (^|/)_phase_ab_incoming(/|$) - [F,L,NC]
  RewriteRule (^|/)backup[^/]*(/|$) - [F,L,NC]
  RewriteRule (^|/)logs?(/|$) - [F,L,NC]
  RewriteRule (^|/)migrations?(/|$) - [F,L,NC]
</IfModule>


# -----------------------------------------
# Block hidden files except .well-known
# -----------------------------------------

<IfModule mod_rewrite.c>
  RewriteRule "(^|/)\.(?!well-known/)" - [F,L]
</IfModule>


# -----------------------------------------
# Basic security response headers
# -----------------------------------------

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>