# Work Tracking - Security Configuration

Options -Indexes -Includes
ServerSignature Off

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block sensitive paths and file types - RewriteRule confirmed to actually
    # work on this OpenLiteSpeed setup, unlike <FilesMatch>/Order,Deny which
    # is not honored here.
    RewriteCond %{REQUEST_URI} ^/(\.git|includes/|config)
    RewriteRule .* - [F,L]
    RewriteCond %{REQUEST_URI} \.(sql|env|log|bak|backup|old|orig|tmp|swp|py)$
    RewriteRule .* - [F,L]

    # Canonical HTTPS
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header unset Server
    Header unset X-Powered-By
</IfModule>