# FAC ArtShop V3
Options -Indexes
DirectoryIndex index.php

# Sécurité (repris du durcissement du 13/10/2026)
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always unset X-Powered-By
    Header unset X-Powered-By
</IfModule>

# Sauvegardes, archives, journaux : jamais servis
<FilesMatch "(?i)\.(bz2|gz|tgz|zip|tar|rar|7z|bak|old|orig|save|swp|log)$">
    Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Toujours en HTTPS (port 80 = HTTP sur l'hébergement OVH)
    RewriteCond %{SERVER_PORT} ^80$
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
    RewriteRule ^(lib|data|lang)(/|$) - [F,L]
    RewriteRule ^admin/?$ admin/index.php [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php?r=$1 [QSA,L]
</IfModule>

<FilesMatch "\.(sqlite|sqlite-wal|sqlite-shm|sql|md)$">
    Require all denied
</FilesMatch>

# Performances : compression et cache navigateur (les CSS/JS sont versionnés par ?v=)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript text/javascript application/json application/xml text/plain text/markdown image/svg+xml
</IfModule>
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"
</IfModule>
