# ═══════════════════════════════════════════════════════
#  ARKON ONLINE — .htaccess  (Güvenlik + Performans)
# ═══════════════════════════════════════════════════════

Options -Indexes -ExecCGI
ServerSignature Off

# ── HASSAS DOSYALARA ERİŞİMİ ENGELLE ───────────────────
<FilesMatch "\.(htaccess|htpasswd|env|log|json|lock|md|sql|bak|ini|sh|py|rb|cfg)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# includes/ klasörüne doğrudan erişim engelle
RewriteRule ^includes/ - [F,L]
RewriteRule ^assets/js/(?!.*\.min\.js) - [F,L]

# ── GÜVENLİK BAŞLIKLARI ─────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options    "nosniff"
    Header always set X-Frame-Options           "SAMEORIGIN"
    Header always set X-XSS-Protection          "1; mode=block"
    Header always set Referrer-Policy           "strict-origin-when-cross-origin"
    Header always set Permissions-Policy        "camera=(), microphone=(), geolocation=()"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    # HSTS (canlı HTTPS'ye geçince aktif et)
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Cache kontrol — hassas sayfalar
    <FilesMatch "\.(php)$">
        Header set Cache-Control "no-store, no-cache, must-revalidate"
        Header set Pragma "no-cache"
    </FilesMatch>

    # Statik dosyalar için cache
    <FilesMatch "\.(jpg|jpeg|png|gif|css|js|woff2?)$">
        Header set Cache-Control "public, max-age=2592000"
    </FilesMatch>
</IfModule>

# ── URL REWRITE ──────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # HTTPS yönlendirmesi (canlı sunucuda aktif et)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # www yönlendirmesi
    # RewriteCond %{HTTP_HOST} !^www\. [NC]
    # RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # Gerçek dosya/dizin değilse index.php'ye git
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^([^.]+)$ index.php?route=$1 [QSA,L]
</IfModule>

# ── KÖTÜ BOT / USER AGENT ENGELLE ───────────────────────
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_USER_AGENT} (havij|nikto|sqlmap|nmap|masscan|zgrab) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (python-requests|curl|wget|libwww|lwp-trivial) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# ── SQL / XSS SALDIRI PATTERN ENGELİ ────────────────────
<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} union.*select [NC,OR]
    RewriteCond %{QUERY_STRING} drop.*table [NC,OR]
    RewriteCond %{QUERY_STRING} (base64_encode|base64_decode) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# ── SIKIŞTIRMA / PERFORMANS ──────────────────────────────
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript
    AddOutputFilterByType DEFLATE text/plain text/xml application/json
</IfModule>

# ── TARAYICI CACHE ───────────────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg    "access plus 1 month"
    ExpiresByType image/jpeg   "access plus 1 month"
    ExpiresByType image/png    "access plus 1 month"
    ExpiresByType image/gif    "access plus 1 month"
    ExpiresByType image/webp   "access plus 1 month"
    ExpiresByType text/css     "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
    ExpiresByType application/x-font-woff2 "access plus 3 months"
</IfModule>

# ── PHP AYARLARI ─────────────────────────────────────────
<IfModule mod_php.c>
    php_flag  display_errors          Off
    php_flag  log_errors              On
    php_flag  session.cookie_httponly On
    php_flag  session.use_strict_mode On
    php_value upload_max_filesize     5M
    php_value post_max_size           8M
    php_value memory_limit            128M
    php_value max_execution_time      30
</IfModule>

# Dosya yükleme kısıtı
LimitRequestBody 10485760

# ── CRON & CONFIG DOSYALARINI WEB'DEN ENGELLE ──────────────
<FilesMatch "^(cron\.php|config\.php)$">
    Order Allow,Deny
    Deny from all
    Allow from 127.0.0.1
    Allow from ::1
</FilesMatch>
