php_flag display_errors Off
php_flag display_startup_errors Off
php_flag log_errors On
php_value error_log "error.log"


# ---------------------------------------------------------------------------
# 1. CORE SECURITY HEADERS (via mod_headers)
# ---------------------------------------------------------------------------
<IfModule mod_headers.c>
    # Prevent MIME-type sniffing (XSS protection)
    Header always set X-Content-Type-Options "nosniff"

    # Clickjacking protection — allow only same-origin framing
    Header always set X-Frame-Options "SAMEORIGIN"

    # Strict Content Security Policy for insurance data
    # Allow jsDelivr for external icon styles (Phosphor icons)
    # Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; style-src-elem 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net; img-src 'self' data: https://marine.ceiil.com.ng https://cdn.jsdelivr.net; connect-src 'self' https://cdn.jsdelivr.net; frame-ancestors 'self'; base-uri 'self'; form-action 'self';"

    # Referrer policy — limit data leakage
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Permissions policy — disable unnecessary browser features
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"

    # HSTS — force HTTPS (uncomment after SSL is confirmed working)
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Remove server signature headers
    Header always unset X-Powered-By
    Header always unset Server
    Header always unset X-Generator
</IfModule>

# ---------------------------------------------------------------------------
# 2. HIDE SERVER SIGNATURES
# ---------------------------------------------------------------------------
ServerSignature Off


# ---------------------------------------------------------------------------
# 3. DISABLE SERVER TOKENS (Apache version leakage)
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    # ServerTokens is set in apache.conf, but we minimize exposure here
</IfModule>

# ---------------------------------------------------------------------------
# 4. DIRECTORY LISTING — ABSOLUTELY FORBIDDEN
# ---------------------------------------------------------------------------
Options -Indexes


# ---------------------------------------------------------------------------
# 5. FOLLOW SYMLINKS — DISABLED (prevents traversal attacks)
# ---------------------------------------------------------------------------
Options -FollowSymLinks
Options +SymLinksIfOwnerMatch


# ---------------------------------------------------------------------------
# 6. FILE UPLOAD SECURITY
# ---------------------------------------------------------------------------
# Block execution of uploaded scripts in uploads directory
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/uploads/ [NC]
    RewriteRule \.(php|php3|php4|php5|phtml|pl|py|jsp|asp|aspx|cgi|sh|bash|exe|dll)$ - [F,L,NC]
</IfModule>

# ---------------------------------------------------------------------------
# 7. SENSITIVE FILE ACCESS DENIAL
# ---------------------------------------------------------------------------
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

<FilesMatch "(composer\.(json|lock)|package\.json|package-lock\.json|yarn\.lock|\.env|\.env\..*|\.gitignore|\.gitattributes|\.htaccess|\.htpasswd|Dockerfile|docker-compose.*\.ya?ml|phpunit\.xml|\.editorconfig|\.travis\.yml|\.gitlab-ci\.yml)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to common sensitive extensions
<FilesMatch "\.(log|sql|sqlite|sqlite3|db|bak|backup|old|orig|swp|swo|swn|git|svn|hg|zip|tar|gz|rar|7z|env|config\.php\.backup)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ---------------------------------------------------------------------------
# 8. CONFIG & LOG DIRECTORY PROTECTION
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to config directory
    RewriteRule ^config/ - [F,L,NC]

    # Block direct access to logs directory
    RewriteRule ^logs/ - [F,L,NC]

    # Block direct access to vendor directory
    RewriteRule ^vendor/ - [F,L,NC]

    # Block direct access to classes directory (PHP logic layer)
    RewriteRule ^classes/ - [F,L,NC]

    # Block direct access to partials directory
    RewriteRule ^partials/ - [F,L,NC]

    # Block direct access to templates directory (if not meant for direct access)
    RewriteRule ^templates/ - [F,L,NC]

    # Block direct access to cron directory scripts
    RewriteRule ^cron/ - [F,L,NC]

    # Block direct access to service directory
    RewriteRule ^service/ - [F,L,NC]

    # Block direct access to processor directory
    #RewriteRule ^processor/ - [F,L,NC]

    # Block direct access to util directory
    RewriteRule ^util/ - [F,L,NC]

    # Block direct access to dompdf internals
    RewriteRule ^dompdf/ - [F,L,NC]

    # Block direct access to phpmailer internals
    RewriteRule ^phpmailer/ - [F,L,NC]
</IfModule>

# Alternative protection using mod_authz_host (Apache 2.4+)
<IfModule mod_authz_core.c>
    <If "%{REQUEST_URI} =~ m#^/(config|logs|vendor|classes|partials|templates|cron|service|processor|util|dompdf|phpmailer)/#">
        Require all denied
    </If>
</IfModule>


# ---------------------------------------------------------------------------
# 9. PHP CONFIGURATION HARDENING
# ---------------------------------------------------------------------------
<IfModule mod_php.c>
    # Disable dangerous functions
    php_value disable_functions "exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,highlight_file,dl,openlog,syslog,readlink,symlink,link,leak,apache_child_terminate,apache_setenv,define_syslog_variables,escapeshellarg,escapeshellcmd"

    # Hide PHP version
    php_flag expose_php Off

    # Limit file uploads
    php_value upload_max_filesize "10M"
    php_value post_max_size "12M"
    php_value max_file_uploads "5"

    # Session security
    php_value session.cookie_httponly 1
    php_value session.cookie_secure 1
    php_value session.use_only_cookies 1
    php_value session.use_trans_sid 0

    # Error display (disable in production)
    php_flag display_errors Off
    php_flag display_startup_errors Off
    php_flag log_errors On
    php_value error_log "logs/php_errors.log"

    # Maximum execution time
    php_value max_execution_time "120"
    php_value max_input_time "60"
    php_value memory_limit "256M"

    # Input filtering
    php_value max_input_vars "3000"
    php_value max_input_nesting_level "64"
</IfModule>

# PHP 7+ / PHP-FPM compatibility
<IfModule mod_proxy_fcgi.c>
    <If "%{REQUEST_URI} =~ m#^/(config|logs|vendor|classes|partials|templates|cron|service|processor|util|dompdf|phpmailer)/#">
        Require all denied
    </If>
</IfModule>


# ---------------------------------------------------------------------------
# 10. URL REWRITING — CLEAN URLS + SECURITY
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS (uncomment in production after SSL is active)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Remove trailing slashes (SEO + prevent duplicate content)
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)/$ /$1 [R=301,L]

    # Block common exploit patterns
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} (concat|union|select|insert|update|delete|drop|create|alter|exec|script|eval)\(.*\) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
    RewriteCond %{QUERY_STRING} (\.{2,}/)+ [OR]
    RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|self/environ) [NC,OR]
    RewriteCond %{QUERY_STRING} (sp_executesql|xp_cmdshell) [NC]
    RewriteRule .* - [F,L]

    # Block SQL injection attempts in URL
    RewriteCond %{REQUEST_URI} (union|select|insert|update|delete|drop|create|alter|exec|script|eval)\(.*\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.{2,}/)+ [OR]
    RewriteCond %{REQUEST_URI} (<|%3C)([^s]*s)+cript [NC]
    RewriteRule .* - [F,L]

    # Block access to common attack vectors
    RewriteCond %{REQUEST_URI} ^/(wp-admin|wp-login|xmlrpc\.php|wp-content|wp-includes|administrator|admin|wp|wordpress) [NC]
    RewriteRule .* - [F,L]

    # Prevent access to .git, .svn, .hg directories
    RewriteRule \.(git|svn|hg)/ - [F,L,NC]
    RewriteRule ^\.git/ - [F,L,NC]
    RewriteRule ^\.svn/ - [F,L,NC]
    RewriteRule ^\.hg/ - [F,L,NC]
</IfModule>


# ---------------------------------------------------------------------------
# 11. RATE LIMITING / BRUTE FORCE PROTECTION
# ---------------------------------------------------------------------------
<IfModule mod_evasive.c>
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   600
    DOSEmailNotify      blessingawodele@gmail.com
    DOSLogDir           "logs/"
</IfModule>


# ---------------------------------------------------------------------------
# 15. COMPRESSION
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE font/woff font/woff2 font/ttf
</IfModule>

# ---------------------------------------------------------------------------
# 17. ERROR DOCUMENTS (Custom error pages)
# ---------------------------------------------------------------------------
ErrorDocument 400 /error.php?code=400
ErrorDocument 401 /error.php?code=401
ErrorDocument 403 /error.php?code=403
ErrorDocument 404 /error.php?code=404
ErrorDocument 405 /error.php?code=405
ErrorDocument 408 /error.php?code=408
ErrorDocument 500 /error.php?code=500
ErrorDocument 502 /error.php?code=502
ErrorDocument 503 /error.php?code=503