# ── Kautuki marketing site ── Apache / cPanel (Hostycare) ──

# Default document
DirectoryIndex index.php index.html

# Force HTTPS (Cloudflare-friendly)
<IfModule mod_rewrite.c>
  RewriteEngine On
  # Force HTTPS in production, but never on local dev hosts
  RewriteCond %{HTTP_HOST} !^localhost [NC]
  RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Pretty URLs, .html first (only if the .html exists). No live page uses this
  # any more — every page is PHP — but it is kept so any old .html URL still
  # resolves if one is ever restored. Note it runs BEFORE the .php rule below,
  # so a stale foo.html would shadow a new foo.php: delete the .html when you
  # convert a page.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI}.html -f
  RewriteRule ^(.+?)/?$ $1.html [L]

  # ...and /classes -> classes.php (the exam-paper pages are PHP for the shared partials)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI}.php -f
  RewriteRule ^(.+?)/?$ $1.php [L]
</IfModule>

# Custom error page
ErrorDocument 404 /404.php

# ── Security headers ──
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  # HSTS (enable once you're confident HTTPS is stable everywhere)
  # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ── Compression ──
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml text/plain
</IfModule>

# ── Caching ──
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/svg+xml "access plus 30 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# Block access to the leads data directory
RedirectMatch 403 ^/leads(/.*)?$