Options -Indexes
DirectoryIndex index.html
AddDefaultCharset UTF-8

<IfModule mod_rewrite.c>
RewriteEngine On
# Pass the Authorization header to PHP (some hosts strip it)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# --- Uncomment the next 3 lines AFTER the free SSL certificate is active, to force https ---
# RewriteCond %{HTTPS} !=on
# RewriteCond %{HTTP:X-Forwarded-Proto} !https
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteRule ^api/?$ api.php [L]
RewriteRule ^sitemap\.xml$ sitemap.php [L]
RewriteRule ^(p|s)/[^/]+/?$ seo.php [L]
RewriteRule ^(p|s)/.+$ index.html [L]
RewriteRule ^shop/.*$ index.html [L]
RewriteRule ^bazarino-control-8f3k2/?$ index.html [L]
</IfModule>

# Never serve internal files
<FilesMatch "^(config\.php|config\.sample\.php|lib\.php|schema\.sql)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "DENY"
  Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'"
</IfModule>
