# =====================================================================
#  Meridian News CMS — Apache configuration
# =====================================================================

# Use our styled 404 page for missing URLs.
ErrorDocument 404 /404.php

# Don't list directory contents.
Options -Indexes

# Default charset
AddDefaultCharset UTF-8

# ---------------------------------------------------------------------
#  Protect sensitive files & folders
# ---------------------------------------------------------------------
<FilesMatch "\.(sql|md|log|ini)$">
  Require all denied
</FilesMatch>

# Block direct web access to config + sql folders
RedirectMatch 404 ^/config/
RedirectMatch 404 ^/sql/
RedirectMatch 404 ^/includes/

# ---------------------------------------------------------------------
#  Performance: cache static assets, enable compression
# ---------------------------------------------------------------------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css            "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/jpeg          "access plus 30 days"
  ExpiresByType image/png           "access plus 30 days"
  ExpiresByType image/webp          "access plus 30 days"
  ExpiresByType image/svg+xml       "access plus 30 days"
</IfModule>

# ---------------------------------------------------------------------
#  Security headers
# ---------------------------------------------------------------------
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
