[orbis] Weekly backup 2026-07-07 — 318 files changed, 48597 insertions(+), 7 deletions(-)

sites/tomsjavajive.com/public_html/.htaccess

@@ -0,0 +1,105 @@
+# Tom's Java Jive - Apache Configuration
+
+# Enable URL rewriting
+RewriteEngine On
+
+# Block sensitive paths outright. RedirectMatch/FilesMatch/Require/Order
+# directives were confirmed NOT to be honored on this LiteSpeed setup (config/,
+# includes/*.php, and .git/ were all still reachable live despite the
+# RedirectMatch rules further down) — only mod_rewrite matching on REQUEST_URI
+# is confirmed to actually work here. This must come before other rewrites.
+RewriteCond %{REQUEST_URI} ^/(\.git|config/|includes/.*\.php|install/|!install!!/|db/)
+RewriteRule .* - [F,L]
+RewriteCond %{REQUEST_URI} \.sql$ [OR]
+RewriteCond %{REQUEST_URI} \.py$
+RewriteRule .* - [F,L]
+
+# Force HTTPS (uncomment in production)
+RewriteCond %{HTTPS} off
+RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+
+# Remove trailing slashes
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_URI} (.+)/$
+RewriteRule ^ %1 [L,R=301]
+
+# Protect sensitive directories
+RedirectMatch 403 /config/.*$
+RedirectMatch 403 /includes/.*\.php$
+RedirectMatch 403 /install/.*$
+RedirectMatch 403 /db/.*$
+
+# Block .git (full source + commit history, including any credentials ever
+# committed to it) from ever being served. NOTE: on the live server this
+# repo's .git directory lives inside the docroot itself (deployed via
+# `git clone` directly into public_html) and was confirmed reachable over
+# HTTP (.git/config, .git/logs/HEAD, etc. all returned real content) even
+# though the RedirectMatch rules above were also confirmed NOT blocking
+# /config/*.php or /includes/*.php live — meaning .htaccess directives are
+# not being fully honored by the current web server. This needs a server
+# config fix (vhost-level deny, or moving .git outside the docroot) in
+# addition to this file — see review notes.
+RedirectMatch 403 /\.git/.*$
+RedirectMatch 403 /\.git$
+
+<FilesMatch "\.sql$">
+    <IfModule mod_authz_core.c>
+        Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order allow,deny
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# Set default charset
+AddDefaultCharset UTF-8
+
+# Disable directory listing
+Options -Indexes
+
+# Set timezone (optional)
+# php_value date.timezone "America/New_York"
+
+# Increase upload limits (adjust as needed)
+php_value upload_max_filesize 10M
+php_value post_max_size 10M
+
+# Enable compression (optional)
+<IfModule mod_deflate.c>
+    AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json
+</IfModule>
+
+# Browser caching (optional)
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresByType image/jpg "access plus 1 year"
+    ExpiresByType image/jpeg "access plus 1 year"
+    ExpiresByType image/png "access plus 1 year"
+    ExpiresByType image/webp "access plus 1 year"
+    ExpiresByType text/css "access plus 1 month"
+    ExpiresByType application/javascript "access plus 1 month"
+</IfModule>
+
+# Security headers
+<IfModule mod_headers.c>
+    Header set X-Content-Type-Options "nosniff"
+    Header set X-Frame-Options "SAMEORIGIN"
+    Header set X-XSS-Protection "1; mode=block"
+</IfModule>
+
+# Custom error pages (optional)
+# ErrorDocument 404 /404.php
+# ErrorDocument 500 /500.php
+# SEO ADDITIONS
+RewriteCond %{HTTP_HOST} ^www\.tomsjavajive\.com [NC]
+RewriteRule ^(.*)$ https://tomsjavajive.com/$1 [R=301,L]
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresByType image/jpg "access plus 1 year"
+    ExpiresByType image/jpeg "access plus 1 year"
+    ExpiresByType image/png "access plus 1 year"
+    ExpiresByType image/webp "access plus 1 year"
+    ExpiresByType text/css "access plus 1 month"
+    ExpiresByType application/javascript "access plus 1 month"
+</IfModule>