# Malongo Arabia — Apache / LiteSpeed configuration (cPanel)

Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS (uncomment once SSL is active — AutoSSL on cPanel)
    # RewriteCond %{HTTPS} !=on
    # RewriteCond %{HTTP:X-Forwarded-Proto} !https
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Force non-www (uncomment if desired)
    # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    # RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

    # Pass Authorization header to PHP (needed by some hosts)
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Block access to sensitive files
    RewriteRule ^(base-path\.php|\.env|composer\.(json|lock))$ - [F,L]

    # Everything that is not an existing file goes to the front controller
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(self)"
    <FilesMatch "\.(woff2|css|js|svg|png|jpe?g|webp|gif|ico)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml text/xml application/xml
</IfModule>

<IfModule mod_mime.c>
    AddType font/woff2 .woff2
    AddType image/webp .webp
    AddType image/svg+xml .svg
</IfModule>
