# ===== Painel Horus — regras de segurança do Apache =====
Options -Indexes -MultiViews
ServerSignature Off
DirectoryIndex index.php

# Bloqueia arquivos sensíveis e ocultos
<FilesMatch "^\.|\.(sql|log|lock|sqlite|bak|ini|md|txt|dist|sh)$">
    Require all denied
</FilesMatch>
<Files "composer.json">
    Require all denied
</Files>

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Pastas internas nunca são acessadas pelo navegador
    RewriteRule ^(app|storage|cron)(/|$) - [F,L]
    # Redireciona para HTTPS (descomente se o site tem SSL e o instalador não forçou)
    # RewriteCond %{HTTPS} !=on
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    <FilesMatch "\.(css|js|png|webp|jpg|svg|ico)$">
        Header set Cache-Control "public, max-age=604800"
    </FilesMatch>
</IfModule>
