# ============================================
# ملف .htaccess المطور (الحماية القصوى + التسريع)
# ============================================

# === Radical Security Shield (STOP BOTS & SCANNERS) ===
RewriteEngine On

# 1. Block Attacking IP (185.193.157.189)
RewriteCond %{REMOTE_ADDR} ^185\.193\.157\.189$
RewriteRule .* - [F,L]

# 2. Block Malicious Bots & User-Agents
RewriteCond %{HTTP_USER_AGENT} (ff3|Python|aiohttp|curl|Wget|libwww|zgrab|masscan|Go-http-client) [NC]
RewriteRule .* - [F,L]

# 3. Block WordPress Scanners (Enabled ONLY if NOT WordPress)
# RewriteRule ^(wp-admin|wp-content|wp-includes|wp-json|xmlrpc\.php) - [F,L]

# 4. Allow Google Verification Files & Bots
RewriteCond %{REQUEST_URI} ^/google[a-z0-9]+\.html$ [OR]
RewriteCond %{HTTP_USER_AGENT} (Googlebot|bingbot|Baiduspider) [NC]
RewriteRule .* - [L]

# 5. Remove 'Accept-Language' Block (Removed to fix Google/SEO Issues)

# === End Shield ===

RewriteEngine On
RewriteBase /

# 0. فرض HTTPS (اختياري - قم بإزالة التعليق إذا كان لديك SSL)
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 1. تنظيف الروابط (SEO)
# إزالة index.php من الرابط
RewriteCond %{THE_REQUEST} /index\.php [NC]
RewriteRule ^index\.php$ / [R=301,L]

# ============================================
# 2. الحماية من الهجمات (Firewall مصغر)
# ============================================

# منع استغلال Query String (SQL Injection & XSS Protection)
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} base64_encode [OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} union.*select [NC]
    RewriteRule .* - [F]
</IfModule>

# حماية الملفات الحساسة وملفات النظام
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

<FilesMatch "(\.(json|sql|log|bak|config|dist|ini|env|sh|inc|swp|py|pyc|phar|phtml)|composer\.lock)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# السماح بالوصول لملفات معينة إذا لزم الأمر
<Files "manifest.json">
    Order allow,deny
    Allow from all
</Files>

# منع استعراض المجلدات
Options -Indexes

# ============================================
# 3. رؤوس الأمان (Security Headers)
# ============================================

<IfModule mod_headers.c>
    # منع الهجمات عبر الإطارات (Clickjacking)
    Header always set X-Frame-Options "SAMEORIGIN"
    # حماية من XSS للمتصفحات القديمة
    Header always set X-XSS-Protection "1; mode=block"
    # منع المتصفح من تخمين نوع الملف (MIME Sniffing)
    Header always set X-Content-Type-Options "nosniff"
    # سياسة المرجعية (الخصوصية)
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    
    # التخزين المؤقت المتقدم (Advanced Caching)
    <FilesMatch "\.(ico|jpg|jpeg|png|gif|webp|svg|js|css|woff2|woff|ttf)$">
        Header set Cache-Control "max-age=31536000, public"
    </FilesMatch>
</IfModule>

# ============================================
# 4. تسريع الموقع (Compression & Caching)
# ============================================

# ضغط GZIP (تقليل حجم الملفات 70%)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/x-javascript application/json application/xml application/rss+xml image/svg+xml font/otf font/ttf font/woff font/woff2
</IfModule>

# التخزين المؤقت في المتصفح (Browser Caching)
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"
    
    # HTML (تحديث فوري أو قصير جداً)
    ExpiresByType text/html "access plus 0 seconds"
    
    # صور وفيديو (سنة)
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType video/mp4 "access plus 1 year"
    
    # CSS و JS (شهر)
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    
    # خطوط (سنة)
    ExpiresByType application/font-woff "access plus 1 year"
    ExpiresByType application/font-woff2 "access plus 1 year"
    ExpiresByType font/ttf "access plus 1 year"
</IfModule>

# ============================================
# 5. أداء PHP (اختياري حسب السيرفر)
# ============================================
<IfModule mod_php.c>
    php_value memory_limit 256M
    php_value max_execution_time 60
    php_value upload_max_filesize 10M
    php_value post_max_size 10M
</IfModule>

# ============================================
# 6. إعادة التوجيه والروابط القديمة
# ============================================

AddDefaultCharset UTF-8

<IfModule mod_rewrite.c>
    # حماية مجلد البيانات
    RewriteRule ^data/.*$ - [F,L]
    
    # حماية مجلد الكاش والترخيص بشكل كامل في أي مسار
    RewriteRule (^|/)\.lic_cache(/|$) - [F,L]

    # توجيهات الصفحات (تم تعطيلها إذا كانت تسبب مشاكل أو الملفات غير موجودة)
    # RewriteRule ^contact\.php$ pages/contact.php [L,R=301]
</IfModule>

# تحويل أي صفحة غير موجودة (404) إلى الرئيسية
ErrorDocument 404 /
# ============================================
# 7. SEO Rules (robots.txt + sitemap.xml)
# ============================================
<IfModule mod_rewrite.c>
    # Allow sitemap.xml access
    RewriteRule ^sitemap\.xml$ sitemap.xml [L]
    
    # Allow robots.txt access
    RewriteRule ^robots\.txt$ robots.txt [L]
    
    # Pretty URL for tools (optional): /tool/123 -> tool.php?id=123
    # Uncomment to enable pretty URLs
    # RewriteRule ^tool/([0-9]+)/?$ tool.php?id=$1 [L]
    # RewriteRule ^tool/([a-zA-Z0-9-]+)/?$ tool.php?id=$1 [L]
</IfModule>

# Ensure robots.txt is served as text/plain
<Files "robots.txt">
    ForceType text/plain
    Order allow,deny
    Allow from all
</Files>

# Ensure sitemap.xml is served as application/xml
<Files "sitemap.xml">
    ForceType application/xml
    Order allow,deny
    Allow from all
</Files>
