
# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php80” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php80 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit



# ----------------------------------------------------------------------
# 1. Disable Directory Browsing
# Prevents attackers from seeing a list of files if index.html is missing
# ----------------------------------------------------------------------
Options -Indexes

# ----------------------------------------------------------------------
# 2. Hide server signature
# Prevents the server from broadcasting its exact version number
# ----------------------------------------------------------------------
ServerSignature Off

# ----------------------------------------------------------------------
# 3. Protect sensitive files
# Deny access to hidden files (files starting with a dot, like .env or .htaccess)
# ----------------------------------------------------------------------
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# ----------------------------------------------------------------------
# 4. Block malicious request methods
# Only allow GET, POST, and HEAD requests. Blocks TRACE/TRACK methods 
# which can be used for Cross-Site Tracing (XST) attacks.
# ----------------------------------------------------------------------
<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

# ----------------------------------------------------------------------
# 5. Security Headers
# These headers instruct the visitor's browser to enforce security rules
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    # Prevent Clickjacking (stops your site from being put in an iframe)
    Header set X-Frame-Options "SAMEORIGIN"

    # Prevent MIME-type sniffing (forces browser to respect your content types)
    Header set X-Content-Type-Options "nosniff"

    # Enable Cross-Site Scripting (XSS) filter in browsers
    Header set X-XSS-Protection "1; mode=block"

    # Enforce HTTPS (Strict-Transport-Security)
    # Note: Only uncomment the next line if you have an SSL certificate installed!
    # Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
    # Remove the X-Powered-By header (hides backend technology info)
    Header unset X-Powered-By
</IfModule>