# ==========================================
# AnubisWeb - Configuración de Seguridad
# ==========================================

# Desactivar listado de directorios
Options -Indexes

# Cabeceras de seguridad HTTP
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always unset X-Powered-By
</IfModule>

# Bloquear acceso a archivos sensibles
<FilesMatch "\.(sql|txt|log|bak|bkp|old|orig|backup|sh|env|ini|conf)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Bloquear archivos de copia/backup PHP
<FilesMatch "(copia|\.bak|backup|copy)\.(php|html?)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Bloquear login sin reCAPTCHA (bypass de seguridad)
<Files "login-sin-recaptcha.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

# Bloquear archivos y directorios ocultos (.git, .env, etc.)
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# No mostrar errores PHP al browser (registrar en log)
php_flag display_errors Off
php_flag log_errors On
