# PRESENSI-SD — pengaturan Apache (XAMPP / shared hosting)
Options -Indexes
DirectoryIndex index.php
ServerSignature Off

# Blokir file sensitif di mana pun
<FilesMatch "\.(sql|md|log|ini|env|bak|old|sh|txt|json|lock|dist)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Batas unggahan (berlaku jika PHP berjalan sebagai modul Apache; di hosting lain atur lewat .user.ini/cPanel)
<IfModule mod_php.c>
    php_value upload_max_filesize 3M
    php_value post_max_size 8M
    php_flag display_errors Off
    php_flag expose_php Off
</IfModule>

# Paksa HTTPS di hosting (hapus tanda # setelah SSL aktif)
# <IfModule mod_rewrite.c>
#     RewriteEngine On
#     RewriteCond %{HTTPS} !=on
#     RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# </IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    # Aktifkan HSTS hanya setelah HTTPS berjalan normal
    # Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>
