# Service Status Portal - web server rules

# Don't list folder contents
Options -Indexes

DirectoryIndex index.php

# The code and settings (statusportal-app) live outside this web folder, so they can't be opened at all.
# Block internal include files (names starting with _) and an app folder uploaded here by mistake.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(app|statusportal-app)(/|$) - [F,L]
  RewriteRule (^|/)_ - [F,L]

  # Force HTTPS (passwords must never be sent unencrypted)
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

# Block non-website files if any are uploaded by mistake
<FilesMatch "\.(md|sql|log|ini|zip|bak)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

# ---------------------------------------------------------------------------
# OPTIONAL extra VPN lock at web-server level (the PHP code already checks
# allowed_ip_ranges in app/config.php). To use it, remove the # in front of the
# lines below and put your VPN public IP address(es) in, one "Require ip" per line.
# Test carefully: a wrong IP here locks everyone out (fix it in cPanel File Manager).
#
# <IfModule mod_authz_core.c>
#   <RequireAny>
#     Require ip 196.0.0.10
#     Require ip 196.0.0.0/28
#   </RequireAny>
# </IfModule>
