# CW – Control & Watch
DirectoryIndex index.php
Options -Indexes

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule "(^|/)(?:\.env(?:\.[^/]+)?|\.git|wp-login\.php|xmlrpc\.php|wp-admin|phpmyadmin|adminer(?:\.php)?|vendor/phpunit|cgi-bin|server-status|\.aws|\.ssh|config\.php\.bak|database\.sql)(?:/|$)" waf-trap.php [L,QSD,NC]
  RewriteRule ^(?:app|components|config|docs|lib|modules|storage|tools|vendor|project/(?:components|config|pages|storage|templates))(?:/|$) - [F,L,NC]

  # Lesbare, versionssichere Frontend-Asset-URLs. Die sichtbare URL enthaelt
  # keine PHP-Endpunkte und keine Query-Parameter; intern bleiben die
  # gehaerteten Asset-Handler fuer Rechte-/MIME-/Cache-Pruefungen erhalten.
  RewriteRule ^assets/project/[^/]+/(.+)$ cw-project-asset.php?file=$1 [END,B]
  RewriteRule ^assets/generated/([a-z][a-z0-9_-]{1,39})/([a-z0-9][a-z0-9_-]{0,119})/((?:style|script)-[a-f0-9]{20}\.(?:css|js))$ cw-content-asset.php?scope=$1&key=$2&file=$3 [END,B]
  RewriteRule ^assets/module/([a-z][a-z0-9_-]*)/[^/]+/(.+)$ cw-module-asset.php?module=$1&file=$2 [END,B]
  RewriteRule ^assets/frontend-tools/[^/]+/(frontend-tools\.(?:css|js))$ cw-frontend-tools-asset.php?file=$1 [END,B]
  RewriteRule ^assets/core/[^/]+/(.+)$ assets/$1 [END]

  RewriteRule ^(?:admin|assets|project/assets|reports)(?:/|$) - [L,NC]
  RewriteRule ^(?:analytics-track|cw-content-asset|cw-download|cw-frontend-tools-asset|cw-module-asset|cw-page-asset|cw-project-asset|form-submit|integrity-cron|notices-event|notices-feed|waf-cron|waf-trap)\.php$ - [L,NC]
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]
  RewriteRule ^ index.php [QSA,L]
</IfModule>

<FilesMatch "\.(?:bak|backup|old|orig|save|sql|sqlite|sqlite3|log|ini|env)$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(?:md|lock|xml)$">
  Require all denied
</FilesMatch>
<FilesMatch "^(?:composer\.json|release-manifest\.json|FLAGS-NOTICE\.txt)$">
  Require all denied
</FilesMatch>
