# ============================================================
# .htaccess — Anti-Bot + Geo-Block (DZ/DE/CH) + Security
# ============================================================

Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
    RewriteEngine On

    # ---------- 1) FORCE HTTPS ----------
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # ---------- 2) BLOCK SEARCH ENGINES + CRAWLERS + SCANNERS ----------
    # استثناء Telegram API من الحظر (حتى لو مرّ الطلب من خلال الموقع)
    RewriteCond %{HTTP_HOST} !^api\.telegram\.org$ [NC]

    RewriteCond %{HTTP_USER_AGENT} (Googlebot|Googlebot-Image|Googlebot-News|Googlebot-Video|Googlebot-Mobile|Google-InspectionTool|Google-Structured-Data-Testing-Tool|Google-Search-By-Image|Google-Page-Speed-Insights|Google-Site-Verification|Google-Safe-Browsing|AdsBot-Google|Mediapartners-Google) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (bingbot|BingPreview|msnbot|adidxbot|Slurp|Yahoo!|DuckDuckBot|DuckDuckGo|Baiduspider|YandexBot|Yandex|Sogou|Exabot) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (facebot|facebookexternalhit|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|Pinterest|Applebot) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|SemrushBot|MJ12bot|DotBot|PetalBot|SeznamBot|Qwantify|CCBot) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (GPTBot|ChatGPT-User|ClaudeBot|anthropic-ai|PerplexityBot|Bytespider|Amazonbot|OAI-SearchBot) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (crawler|spider|scraper|archiver|fetcher|indexer) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (-bot|bot/|bot\ ) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (VirusTotal|virustotal|urlscan|urlscan\.io|PhishTank|phishtank|OpenPhish|openphish|Sucuri|sucuri|SiteLock|sitelock|WordFence|wordfence) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (Nikto|nikto|nmap|Nmap|sqlmap|SQLMap|OpenVAS|openvas|Nessus|nessus|Acunetix|acunetix|Netsparker|netsparker|AppScan|appscan|Burp|burp|ZAP|zaproxy) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (curl/|Wget/|wget/|python-requests|python-urllib|Go-http-client|libwww-perl) [NC]
    RewriteRule ^ - [F,L]

    # ---------- 3) BLOCK SECURITY HEADERS ----------
    RewriteCond %{HTTP:X-Security-Scan} !^$ [OR]
    RewriteCond %{HTTP:X-Security-Crawler} !^$ [OR]
    RewriteCond %{HTTP:X-Security-Bot} !^$ [OR]
    RewriteCond %{HTTP:X-Security-Spider} !^$ [OR]
    RewriteCond %{HTTP:X-Threat-Intelligence} !^$ [OR]
    RewriteCond %{HTTP:X-Site-Verification} !^$ [OR]
    RewriteCond %{HTTP:X-Domain-Verification} !^$ [OR]
    RewriteCond %{HTTP:X-SSL-Verification} !^$ [OR]
    RewriteCond %{HTTP:X-DNS-Verification} !^$ [OR]
    RewriteCond %{HTTP:X-WHOIS-Verification} !^$
    RewriteRule ^ - [F,L]

    # ---------- 4) GEO-BLOCK (DZ/DE/CH ghir) ----------
    # Cloudflare:
    # RewriteCond %{HTTP:CF-IPCountry} !^$
    # RewriteCond %{HTTP:CF-IPCountry} !^(DZ|DE|CH)$
    # RewriteRule ^ - [F,L]

    # MaxMind GeoIP:
    # <IfModule mod_geoip.c>
    #     GeoIPEnable On
    #     RewriteCond %{GEOIP_COUNTRY_CODE} !^(DZ|DE|CH)$
    #     RewriteRule ^ - [F,L]
    # </IfModule>

</IfModule>

# ============================================================
# SECURITY HEADERS
# ============================================================
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ============================================================
# BLOCK SENSITIVE FILES
# ============================================================
<FilesMatch "^(\.env|\.git|\.htaccess|\.htpasswd|composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|\.DS_Store|web\.config|php\.ini|\.user\.ini)$">
    Require all denied
</FilesMatch>

<FilesMatch "\.(sql|log|bak|old|swp|ini|conf|dist|md)$">
    Require all denied
</FilesMatch>

# ============================================================
# PHP HARDENING
# ============================================================
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value upload_max_filesize 8M
    php_value post_max_size 8M
    # allow_url_fopen يبقى Off أمنياً — استخدم curl في الكود
    php_flag allow_url_fopen Off
</IfModule>

# ============================================================
# CACHE STATIC
# ============================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpeg "access plus 7 days"
    ExpiresByType image/png  "access plus 7 days"
    ExpiresByType image/gif  "access plus 7 days"
    ExpiresByType image/webp "access plus 7 days"
    ExpiresByType text/css   "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
</IfModule>

# ============================================================
# CUSTOM 403 PAGE (optional)
# ============================================================
ErrorDocument 403 /403.html