Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
RewriteEngine On
# Never serve private/server implementation folders directly.
RewriteRule ^(?:includes|storage|data|ai|deploy|tools)(?:/|$) - [F,L,NC]
# Permanently retire old KLYRO AI, Learn, exams, billing and model endpoints.
RewriteRule ^(?:api/(?:agent|klyro|model|learn|exam|workspace|billing)|auth/github(?:_callback)?\.php) - [G,L,NC]
RewriteRule ^(?:workspace|creator|projects|pricing|billing|learn(?:-[a-z-]+)?|exam(?:-[a-z-]+)?|certificate(?:-[a-z-]+)?|model-feed|mcp|servers|setup-auth|setup-check)\.php$ - [G,L,NC]
RewriteRule \.(?:zip|gz|tar|sql|sqlite|log|bak|env|key|pem|md|json|yml|yaml|sh|txt)$ - [F,L,NC]
# Retired Server Agent endpoints stay blocked even if old files remain after an in-place upgrade.
RewriteRule ^api/agent(?:/|$) - [G,L,NC]
RewriteRule ^servers\.php$ - [G,L,NC]
# Reject TRACE/TRACK where the server exposes them.
RewriteCond %{REQUEST_METHOD} ^(?:TRACE|TRACK)$ [NC]
RewriteRule .* - [F,L]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Strict-Transport-Security "max-age=15552000"
  <FilesMatch "\.(css|js)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
</IfModule>

<FilesMatch "(^\.|^config\.php$|^staff-local\.php$|^guard-local\.php$|^model-update-local\.php$|\.sqlite(?:-wal|-shm)?$|\.sql$|\.key$|\.pem$|\.log$|\.bak$|\.env$|^README.*|^MODEL_.*\.md$|^LICENSE_.*\.txt$|^CLOUDFLARE_.*\.js$|\.md$|\.example\.json$)">
  Require all denied
</FilesMatch>
