
# ==========================================================
# ADELANTO GUATEMALA - CREDITO EMPLEADO
# SSL + HTTPS + WWW + SEGURIDAD + RENDIMIENTO
# ==========================================================

Options -Indexes
AddDefaultCharset UTF-8

# ==========================================================
# 1. REDIRECCION HTTPS + WWW
# ==========================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Permitir validacion SSL AutoSSL / Let's Encrypt
    RewriteRule ^\.well-known/acme-challenge/ - [L]

    # No forzar HTTPS en localhost / XAMPP
    RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$ [NC]

    # Redirigir dominio sin www o sin HTTPS
    RewriteCond %{HTTPS} !=on [OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC,OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]

    RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]
</IfModule>

# ==========================================================
# 2. CABECERAS DE SEGURIDAD
# ==========================================================

<IfModule mod_headers.c>

    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # HSTS solo cuando la conexion es HTTPS
    Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS

</IfModule>

# ==========================================================
# 3. PROTECCION DE ARCHIVOS SENSIBLES
# ==========================================================

<FilesMatch "(^\.env$|\.sql$|\.log$|\.lock$|\.example$|^\.git|composer\.(json|lock)$|\.md$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "^(db\.local\.php|config\.local\.php)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ==========================================================
# 4. COMPRESION GZIP
# ==========================================================

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml
    AddOutputFilterByType DEFLATE text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# ==========================================================
# 5. CACHE DEL NAVEGADOR
# ==========================================================

<IfModule mod_expires.c>
    ExpiresActive On

    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"

    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"

    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# ==========================================================
# FIN DE CONFIGURACION
# ==========================================================
