# MSORGVTU hardening patch
Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
RewriteEngine On

# Force HTTPS for every request.
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Block direct access to dumps, backups, logs, config, and hidden files.
<FilesMatch "(?i)(^\.|\.env$|composer\.(json|lock)$|package(-lock)?\.json$|yarn\.lock$|.*\.(sql|log|zip|bak|backup|old|swp|ini|conf|config|dist|md|sh|ps1)$)">
    Require all denied
</FilesMatch>

# Block PHP execution inside upload folders.
<IfModule mod_rewrite.c>
RewriteRule ^upload/.*\.(php|phtml|phar)$ - [F,L,NC]
</IfModule>

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
# CSP is intentionally moderate to avoid breaking legacy inline scripts.
Header always set Content-Security-Policy "upgrade-insecure-requests; block-all-mixed-content; frame-ancestors 'self'; base-uri 'self'; object-src 'none'"
</IfModule>
