# ═══════════════════════════════════════════════════════════════════
# ELZEM-TUBE SECURITY & SEO
# ═══════════════════════════════════════════════════════════════════

RewriteEngine On

# ── HTTPS Force ──────────────────────────────────────────────────
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# ── Sitemap & Robots ─────────────────────────────────────────────
RewriteRule ^sitemap\.xml$ index.php?elzem_sitemap=1 [L]
RewriteRule ^robots\.txt$ index.php?elzem_robots=1 [L]

# ── Clean URLs ───────────────────────────────────────────────────
RewriteRule ^(privacy|terms|contact)$ index.php?page=$1 [L,QSA]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)\.html$ index.php?permalink=$1 [L,QSA]

# ── Block sensitive files ────────────────────────────────────────
<FilesMatch "\.(json|md|log|env)$">
    Require all denied
</FilesMatch>

<FilesMatch "^(data/|includes/|vendor/)">
    Require all denied
</FilesMatch>

# ── Hotlink Protection ──────────────────────────────────────────
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?%{HTTP_HOST}/ [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?elzem2012\.website/ [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp|svg|ico)$ - [F,L]

# ── Security Headers ─────────────────────────────────────────────
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ── Block Bad Bots ──────────────────────────────────────────────
RewriteCond %{HTTP_USER_AGENT} (ahrefs|majestic|rogerbot|semrush|spbot|screaming) [NC]
RewriteRule .* - [F,L]

# ── Cache ────────────────────────────────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
</IfModule>
