Options -Indexes
DirectoryIndex index.html

RewriteEngine On

# Force HTTPS in production only (skip localhost/local dev to avoid browser
# certificate warnings from XAMPP's self-signed SSL cert).
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} !^localhost(:\d+)?$ [NC]
RewriteCond %{HTTP_HOST} !^127\.0\.0\.1(:\d+)?$
RewriteCond %{HTTP_HOST} !^\[?::1\]?(:\d+)?$
RewriteCond %{HTTP_HOST} !\.(local|test)$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# WWW -> non-WWW (production only).
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteCond %{HTTP_HOST} !^www\.localhost(:\d+)?$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# Allow the protected one-time account seed URL to execute directly.
RewriteRule ^api/seed-owner\.php$ - [L]

# Route /api/auth/... and other API paths to the PHP entry point.
RewriteRule ^api/(.*)$ api/index.php [L,QSA]

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# Never expose SQL dumps, documentation, environment files, or PHP internals.
<FilesMatch "\.(sql|md|env|lock)$|^\.|^(config|db|mailer|providers|setup)\.php$">
  Require all denied
</FilesMatch>

ErrorDocument 404 /404.html