# ==========================================================================
#  Filter Element Cross-Reference
#
#  Written to work on Apache and on LiteSpeed. LiteSpeed reads .htaccess, but
#  shared LiteSpeed hosting differs from XAMPP's Apache in two ways that
#  matter here, and both are handled below:
#
#    1. It may not have a text/css mapping for this folder. Combined with the
#       nosniff header further down, a stylesheet served as text/plain is
#       silently refused by the browser and the site renders unstyled — with
#       nothing in any error log. The AddType block prevents that.
#    2. PHP directives (php_flag, php_value) in .htaccess return a 500 under
#       LSAPI and suPHP. There are none in this application.
#
#  If anything here is rejected by your host, diagnose.php will say so.
# ==========================================================================

DirectoryIndex index.php

# ---- MIME types ----------------------------------------------------------
# Declared explicitly rather than relying on the server's defaults. This is
# the single most common cause of "it looks fine locally but unstyled on the
# host".
<IfModule mod_mime.c>
    AddType text/css                    .css
    AddType application/javascript      .js
    AddType application/json            .json
    AddType application/pdf             .pdf
    AddType image/svg+xml               .svg
    AddType font/woff2                  .woff2
</IfModule>

# ---- no directory listings -----------------------------------------------
# IndexIgnore rather than "Options -Indexes": many shared hosts refuse
# Options in .htaccess and 500 the whole folder when they see it.
<IfModule mod_autoindex.c>
    IndexIgnore *
</IfModule>

# ---- security headers ----------------------------------------------------
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "same-origin"
</IfModule>

# ---- caching -------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css               "access plus 1 day"
    ExpiresByType application/javascript "access plus 1 day"
    ExpiresByType application/pdf        "access plus 7 days"
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
</IfModule>

# ---- LiteSpeed Cache -----------------------------------------------------
# The pages are per-request and the theme layer depends on the order the
# stylesheets load, which LSCache's combine/defer optimisation does not
# preserve. Keep this folder out of the cache.
<IfModule LiteSpeed>
    CacheDisable public /
</IfModule>

# ---- never serve the database --------------------------------------------
<FilesMatch "\.(sqlite|sqlite3|db|journal|wal|shm)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
