# =========================================================
# BASIC SECURITY
# =========================================================
ServerSignature Off
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On
# =========================================================
# RUTE PUBLIC
# =========================================================
RewriteRule ^assets/(.*)$ public/assets/$1 [L]

RewriteRule ^build/(.*)$ public/build/$1 [L]

RewriteRule ^storage/(.*)$ public/storage/$1 [L]

RewriteRule ^favicon\.ico$ public/favicon.ico [L]

RewriteRule ^robots\.txt$ public/robots.txt [L]

# =========================================================
# BLOCK CUSTOM PATH
# =========================================================
RewriteRule ^docs - [F,L]

# =========================================================
# BLOCK NOCACHE PARAM ON ALL ENDPOINTS
# =========================================================
RewriteCond %{QUERY_STRING} (^|&)nocache= [NC]
RewriteRule .* - [F,L]

# =========================================================
# BLOCK LONG QUERY STRING
# =========================================================
RewriteCond %{QUERY_STRING} .{200,}
RewriteRule .* - [F,L]

# =========================================================
# BLOCK WHM STATUS
# =========================================================
RewriteCond %{REQUEST_URI} ^/whm-server-status [NC]
RewriteRule .* - [F,L]

# =========================================================
# BLOCK COMMON EXPLOITS
# =========================================================
RewriteCond %{REQUEST_URI} (\.env|phpunit|eval-stdin|\.git|cgi-bin|vendor/phpunit) [NC,OR]
RewriteCond %{QUERY_STRING} (base64_encode|eval\(|php://input|allow_url_include) [NC,OR]
RewriteCond %{REQUEST_URI} \.\./ [OR]
RewriteCond %{QUERY_STRING} \.\./ [OR]
RewriteCond %{REQUEST_URI} /cgi-bin [NC]
RewriteRule .* - [F,L]

# =========================================================
# BLOCK SENSITIVE FILES
# =========================================================
<FilesMatch "^(\.env|artisan|composer\.lock|package\.json|server\.php|phpunit\.xml)$">
Require all denied
</FilesMatch>

# =========================================================
# BLOCK LARAVEL CORE FOLDERS
# =========================================================
RedirectMatch 404 ^/(app|bootstrap|config|database|resources|routes|storage|tests|vendor)/

# =========================================================
# BLOCK BAD BOTS / SCANNERS
# =========================================================
# SetEnvIfNoCase User-Agent "libredtail|zgrab|sqlmap|nikto|masscan|nmap|curl|python" bad_bot

# Order Allow,Deny
# Allow from all
# Deny from env=bad_bot

# =========================================================
# API EXCEPTION
# =========================================================
RewriteCond %{REQUEST_URI} ^/api/webhook/ [OR]
RewriteCond %{REQUEST_URI} ^/api/v2/order/.*/check-otp$
RewriteRule .* - [L]

# =========================================================
# API PROTECTION
# =========================================================
RewriteCond %{REQUEST_URI} ^/api/
RewriteCond %{HTTP:Authorization} ^$
RewriteRule .* - [F,L]

# =========================================================
# VALIDATE BEARER TOKEN
# =========================================================
RewriteCond %{REQUEST_URI} ^/api/
RewriteCond %{HTTP:Authorization} !^Bearer\s[A-Za-z0-9\-\._]{20,}$
RewriteRule .* - [F,L]

# =========================================================
# STATIC FILES
# =========================================================
RewriteCond %{REQUEST_URI} \.(css|js|jpg|jpeg|png|webp|gif|ico|svg|woff|woff2|ttf)$ [NC]
RewriteRule .* - [L]

# =========================================================
# FORCE HTTPS
# =========================================================
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# =========================================================
# FORCE NON-WWW
# =========================================================
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# Homepage langsung ke file HTML (HAPUs JIKA INGIN PAKE BLADE)


# =========================================================
# LARAVEL ROUTING
# =========================================================
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]

</IfModule>

# =========================================================
# SLOW REQUEST PROTECTION
# =========================================================
<IfModule mod_reqtimeout.c>
RequestReadTimeout header=10-20,MinRate=500 body=10,MinRate=500
</IfModule>

# =========================================================
# LITESPEED CACHE
# =========================================================
<IfModule LiteSpeed>
CacheLookup public on
</IfModule>

# =========================================================
# STATIC FILE CACHE
# =========================================================
<IfModule mod_headers.c>

<FilesMatch "\.(css|js|jpg|jpeg|webp|png|gif|svg|woff|woff2|ttf)$">
Header set Cache-Control "public, max-age=2592000"
</FilesMatch>

</IfModule>

# =========================================================
# PHP HANDLER
# =========================================================
<IfModule mime_module>
AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
