# NEWPAY root protection — kompatibel aaPanel (Apache) & WHM/cPanel
# upload ke docroot sejajar index.php

DirectoryIndex index.php
Options -Indexes

# ---------------- REWRITE ----------------
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # DENY duluan: folder internal (logs/data/Tembuluk) — [F] = 403, aman di semua Apache
    RewriteRule ^(logs|data|Tembuluk)(/|$) - [F,L]

    # file & folder beneran -> serve langsung
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # sisanya lewat front controller
    RewriteRule ^ index.php [L]
</IfModule>

# ---------------- DENY: file sensitif ----------------
<FilesMatch "^(admin_config\.php|composer\.(json|lock)|package(-lock)?\.json|\.env|\.git.*)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ---------------- DENY: ekstensi log/txt/db di mana pun ----------------
<FilesMatch "\.(log|txt|sql|db|sqlite|bak|old|ini|sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ---------------- PHP hardening ----------------
# php_flag cuma jalan kalau PHP = mod_php; WHM/cPanel biasanya FPM/suPHP -> di-skip otomatis
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
</IfModule>

# ---------------- security headers ----------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ---------------- error pages polos ----------------
ErrorDocument 403 "Forbidden"
ErrorDocument 404 "Not Found"
