# Aalterpaint Portal — private site lock-down (Apache / cPanel)
Options -Indexes
DirectoryIndex index.html
ServerSignature Off

<IfModule mod_headers.c>
  Header always set X-Robots-Tag "noindex, nofollow, noarchive, nosnippet, noimageindex"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "same-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
  <FilesMatch "\.(html|php)$">
    Header set Cache-Control "no-store"
  </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # HTTPS only (skipped on localhost for testing)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$ [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Block search engines, SEO tools and AI crawlers outright (robots.txt is still served)
  RewriteCond %{REQUEST_URI} !^/robots\.txt$
  RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|slurp|scrapy|python-requests|curl/|wget|httpclient|headless|GPTBot|ChatGPT|OAI-SearchBot|ClaudeBot|Claude-Web|anthropic|CCBot|Google-Extended|GoogleOther|PerplexityBot|Bytespider|Amazonbot|Applebot|FacebookBot|meta-externalagent|Diffbot|ImagesiftBot|cohere|YouBot|Timpibot|omgili|AhrefsBot|SemrushBot|MJ12bot|DotBot|PetalBot|YandexBot|Baiduspider|DuckDuckBot|bingbot|Googlebot) [NC]
  RewriteRule ^ - [F,L]

  # Never serve shared code, data, databases, logs or hidden files
  RewriteRule ^_shared(/|$) - [F,L]
  RewriteCond %{REQUEST_URI} !^/\.well-known/
  RewriteRule (^|/)\. - [F,L]
  RewriteRule \.(sqlite|sqlite3|db|log|bak|sql|ini|md)$ - [F,L]
  RewriteRule (^|/)(lib|module)\.php$ - [F,L]
</IfModule>

<FilesMatch "\.(sqlite|sqlite3|db|log|bak|sql|ini|md)$">
  Require all denied
</FilesMatch>
