# =====================================================================
#  Root .htaccess — deploy this at your public_html root alongside
#  img.php, the api/ folder, and your website files.
# =====================================================================

RewriteEngine On

# Pretty links: /{username}-vip-{shortid}  and  /{username}-free-{shortid}
# Usernames are 3-20 chars [a-zA-Z0-9_], short ids are base62.
RewriteRule ^([a-zA-Z0-9_]{3,20})-(vip|free)-([a-zA-Z0-9]{4,20})/?$ img.php?u=$1&t=$2&id=$3 [L,QSA]

# Never let PHP execute inside the storage folder, whatever happens.
<IfModule mod_php.c>
    <Directory "storage">
        php_flag engine off
    </Directory>
</IfModule>

# Block dotfiles (.env, .git, etc.) and raw config/database folders from ever
# being served directly, defense-in-depth on top of them being outside
# public_html where possible.
RewriteRule ^\.(?!well-known) - [F]
RewriteRule ^database/ - [F]

# Baseline security headers (also set per-response in PHP; this covers
# static files too).
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>

# Hide directory listings.
Options -Indexes
