# BMU Group — site-wide security headers.
# Applies to every response (public pages and the admin panel alike).
# Requires mod_headers, which is enabled on virtually all shared hosting —
# wrapped in <IfModule> so a host without it just skips these silently
# rather than failing the whole site.
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  # Basic clickjacking/XSS-mitigation headers only — no Content-Security-Policy
  # here, since the front-end intentionally loads GSAP/Lenis/Google Fonts from
  # third-party CDNs (see assets/css, assets/js). Add a CSP once the exact set
  # of external hosts is finalized for your deployment; a wrong CSP is worse
  # than none, so it's left for deliberate configuration rather than guessed.
</IfModule>

# Never serve directory listings.
Options -Indexes

# --- Phase 1 → Phase 2 URL migration -----------------------------------
# The old static build used .html pages. Phase 2 replaced them with dynamic
# .php equivalents of the same name. If any of the old .html files are still
# sitting on the server (e.g. left over from before this build was uploaded),
# make sure index.html never wins as the default document over index.php —
# and send anyone hitting an old .html URL (bookmarks, search engine index,
# old links) on to the real page instead of a dead static file.
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{THE_REQUEST} \s/+(index|about|services|projects|contact)\.html[\s?] [NC]
  RewriteRule ^(index|about|services|projects|contact)\.html$ /$1.php [R=301,L]
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php84” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php84 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
