# php -- BEGIN cPanel-generated handler, do not edit
# Configure el paquete "ea-php81" como el lenguaje de programación predeterminado "PHP".
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

# ==============================================================================
# REGLAS DE SEGURIDAD PERSONALIZADAS - BIBLIOTECA VIRTUAL ITAE
# ==============================================================================

# 1. REDIRECCIÓN HTTPS
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

# 2. BLOQUEAR LISTADO DE DIRECTORIOS
Options -Indexes

# 3. BLOQUEAR ACCESO A ARCHIVOS SENSIBLES
<FilesMatch "^(\.htaccess|\.htpasswd|error_log|composer\.json|composer\.lock|\.env|\.git|\.gitignore)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# 4. BLOQUEAR ACCESO A ARCHIVOS DE CONFIGURACIÓN
<FilesMatch "\.(log|ini|conf|config|yml|yaml|json|sql|sqlite|db|lock)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# 5. PROTEGER ARCHIVOS DE ERROR LOG
<Files "error_log">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

# 6. CABECERAS DE SEGURIDAD HTTP
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>

# 7. COMPRESIÓN GZIP
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript text/js text/json
    AddOutputFilterByType DEFLATE application/javascript application/json application/xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# 8. CACHÉ DE ARCHIVOS ESTÁTICOS
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
</IfModule>