# FormDesk — Apache / LiteSpeed (cPanel)
Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Force HTTPS (comment out while testing on http)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Pretty public links used in QR codes and emails
  RewriteRule ^f/([a-z0-9\-]+)/?$        index.php?r=f&a=$1    [L,QSA]
  RewriteRule ^track/?([A-Za-z0-9\-]*)$  index.php?r=track&a=$1 [L,QSA]
  RewriteRule ^(app|home|login)/?$       index.php?r=home       [L,QSA]
  RewriteRule ^case/([A-Za-z0-9\-]+)/?$  index.php?r=case&a=$1  [L,QSA]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
  <FilesMatch "\.(css|js|svg|png|woff2?)$">
    Header set Cache-Control "public, max-age=604800, immutable"
  </FilesMatch>
</IfModule>

# Never serve these from the web root
<FilesMatch "^(\.|composer\.|package\.|README)">
  Require all denied
</FilesMatch>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# PHP hardening (cPanel MultiPHP INI editor is the preferred place for these)
<IfModule mod_php.c>
  php_flag display_errors Off
  php_value upload_max_filesize 12M
  php_value post_max_size 64M
</IfModule>
