# FastSolutions — Apache / cPanel / LiteSpeed
# Sube este archivo a la raíz del sitio (mismo nivel que index.html).
# No subas web.config si el hosting es Apache.

Options -Indexes -MultiViews
ServerSignature Off
FileETag None
AddDefaultCharset UTF-8

<IfModule mod_mime.c>
  AddType image/svg+xml .svg
  AddType application/manifest+json .webmanifest
  AddType application/json .json
</IfModule>

ErrorDocument 404 /404.html
ErrorDocument 403 /404.html

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # No redirigir el reto SSL de Let's Encrypt
  RewriteRule ^\.well-known/acme-challenge/ - [L]

  # HTTPS (incluye proxy / Cloudflare)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
  RewriteRule ^ https://fastsolutionhn.com%{REQUEST_URI} [L,R=301]

  # www y cualquier host distinto → dominio canónico
  RewriteCond %{HTTP_HOST} !^fastsolutionhn\.com$ [NC]
  RewriteRule ^ https://fastsolutionhn.com%{REQUEST_URI} [L,R=301]

  # Bloquear rutas internas aunque se suban por error
  RewriteRule ^tools(/|$) - [R=404,L]
  RewriteRule (^|/)\.git - [R=404,L]
</IfModule>

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; img-src 'self' data:; font-src 'self' https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline'; connect-src 'self' https://ipwho.is; upgrade-insecure-requests"
  Header always unset X-Powered-By
  Header unset X-Powered-By
</IfModule>

<FilesMatch "(^web\.config$|^README\.md$|^Untitled$|\.jsonl$|\.htpasswd$|^contacto-enviar-config\.php$)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_authz_core.c>
  <FilesMatch "^\.">
    Require all denied
  </FilesMatch>
</IfModule>
