Options -Indexes -MultiViews
ServerSignature Off
FileETag None

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"
  Header always unset X-Powered-By
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Never expose private or operational folders from the web root.
  RewriteRule ^(?:data|cache|sql|xampp)(?:/|$) - [F,L,NC]

  # Only allow the methods used by this app.
  RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$ [NC]
  RewriteRule ^ - [F,L]


  # Friendly routes for public content.
  RewriteRule ^noticias/?$ news.php [L,QSA,NC]
  RewriteRule ^noticias/([A-Za-z0-9-]+)/?$ news-detail.php?slug=$1 [L,QSA,NC]
  RewriteRule ^descargas/?$ downloads.php [L,QSA,NC]
  RewriteRule ^descargas/([A-Za-z0-9-]+)/?$ download-detail.php?slug=$1 [L,QSA,NC]
  RewriteRule ^donaciones/?$ donations.php [L,QSA,NC]
  RewriteRule ^personajes/([^/]+)/?$ character-profile.php?name=$1 [L,QSA,NC]
  RewriteRule ^guilds/([^/]+)/?$ guild-profile.php?name=$1 [L,QSA,NC]

  # Optional HTTPS redirect. Enable from Apache with: SetEnv APP_FORCE_HTTPS 1
  RewriteCond %{ENV:APP_FORCE_HTTPS} =1 [OR]
  RewriteCond %{HTTP:X-Forwarded-Proto} =http [NC]
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

<FilesMatch "(^\.|\.bak$|\.sql$|\.sqlite$|README\.md$|composer\.(json|lock)$|\.ini$|\.log$)">
  Require all denied
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
</FilesMatch>
