# 月账 · Monthly Ledger — root .htaccess
# Blocks direct web access to internal folders and disables directory listing.
# Everything under includes/, database/, logs/, backups/, sessions/ is
# PHP/SQL/log/session data that must never be served directly to a browser.

Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(includes|database|logs|backups|sessions)(/|$) - [F,L]

    # Go-live (docs/DEPLOY.md, step 4): uncomment once HTTPS is active to
    # force every request onto it. Left off for local XAMPP (HTTP-only).
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule !mod_rewrite.c>
    RedirectMatch 403 ^/(includes|database|logs|backups|sessions)(/|$)
</IfModule>

# Defense in depth: never serve a stray .sql/.md file if one is ever left
# in the web root by mistake (e.g. a manual backup download or this repo's
# own docs/ folder, if it's ever uploaded outside of docs/ intentionally).
<FilesMatch "\.(sql|md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Baseline security headers — harmless in dev, expected in production.
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
