# cfforex.id — server config for Hostinger (Apache/LiteSpeed).
# NOTE: if the site moves to Vercel/Cloudflare, this file is ignored there —
# the equivalent rules move to vercel.json / _headers instead.

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Canonical host: send www → apex (avoids duplicate content)
  RewriteCond %{HTTP_HOST} ^www\.cfforex\.id$ [NC]
  RewriteRule ^(.*)$ https://cfforex.id/$1 [R=301,L]

  # Force HTTPS
  RewriteCond %{HTTPS} !=on
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # Block legacy WordPress attack-scanner paths (this is a static Astro site) → 403
  RewriteRule ^(wp-admin|wp-includes|wp-content)(/|$) - [F,L,NC]
  RewriteRule ^(wp-login\.php|xmlrpc\.php)$ - [F,L,NC]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=15768000"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>
