# Root – security hardening for Apache/cPanel/LiteSpeed deployments.
# Blocks direct HTTP access to secrets, configs, logs, and infra files
# that must never be served as static files.

Options -Indexes -MultiViews

# Deny all dotfiles (.env, .git, .htpasswd, etc.) except the well-known ACME
# challenge directory used for SSL issuance.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} !^/\.well-known/
    RewriteCond %{REQUEST_URI} /\.[^/]+$
    RewriteRule ^ - [F,L]
</IfModule>

# Fallback for servers without mod_rewrite: deny by filename pattern.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Sensitive project files that must never be downloadable, even without a
# leading dot.
<FilesMatch "^(docker-compose\.ya?ml|Dockerfile|install\.sh|error_log|.*\.log|text\.json|product\.json|product_name\.json|composer\.(json|lock)|package(-lock)?\.json|README\.md|CHANGELOG.*|\.htpasswd|config\.php\.bak.*)$">
    Require all denied
</FilesMatch>

# Never allow directory listing of raw source in folders that hold data
# exported for representative/sub-bots.
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_URI} ^/vpnbot/[^/]+/(\.env.*|docker-compose\.ya?ml|install\.sh|error_log|text\.json|product\.json|product_name\.json)$
    RewriteRule ^ - [F,L]
</IfModule>
