# Günce cPanel Security & Performance

# Enable compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
  BrowserMatch ^Mozilla/4 no-gzip
  BrowserMatch ^Mozilla/4\.0[678] no-gzip
  BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType application/x-javascript "access plus 1 month"
  ExpiresDefault "access plus 2 days"
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header set X-Frame-Options "DENY"
  Header set X-Content-Type-Options "nosniff"
  Header set Referrer-Policy "same-origin"
  Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
</IfModule>

# Disable directory listing
Options -Indexes

# Protect sensitive directories
<FilesMatch "\.(htaccess|htpasswd|env|json|lock)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

# Enable HTTPS redirect (if SSL is available)
<IfModule mod_rewrite.c>
  RewriteEngine On
  
  # Redirect to HTTPS if available
  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  
  # Remove .php extension
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^([a-zA-Z0-9_-]+)/?$ $1.php [QSA]
</IfModule>

# PHP Security Settings (cPanel safe mode)
<IfModule mod_php7.c>
  php_flag register_globals off
  php_flag magic_quotes_gpc off
  php_value upload_max_filesize 100M
  php_value post_max_size 100M
  php_value max_execution_time 300
  php_value max_input_time 300
</IfModule>

# SQLite database protection
<FilesMatch "\.sqlite$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

# Sessions directory protection
<DirectoryMatch "^.*/sessions">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</DirectoryMatch>

# Data directory protection
<DirectoryMatch "^.*/\.gunce-data">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</DirectoryMatch>

# Allow only necessary file types
<FilesMatch "\.php$">
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>
</FilesMatch>

# Protect admin panel
<Files "control.php">
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>
</Files>
