From a4ebf26a4868044f43fb704cf7806c263186658a Mon Sep 17 00:00:00 2001
From: Myron Blair <myronblair@outlook.com>
Date: Sat, 4 Jul 2026 15:57:18 -0500
Subject: [PATCH] Harden .git/config/includes/db block: RedirectMatch not
 honored, use mod_rewrite REQUEST_URI matching

---
 .htaccess | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.htaccess b/.htaccess
index fbeaf2e..745dda8 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,6 +3,16 @@
 # Enable URL rewriting
 RewriteEngine On
 
+# Block sensitive paths outright. RedirectMatch/FilesMatch/Require/Order
+# directives were confirmed NOT to be honored on this LiteSpeed setup (config/,
+# includes/*.php, and .git/ were all still reachable live despite the
+# RedirectMatch rules further down) — only mod_rewrite matching on REQUEST_URI
+# is confirmed to actually work here. This must come before other rewrites.
+RewriteCond %{REQUEST_URI} ^/(\.git|config/|includes/.*\.php|install/|db/)
+RewriteRule .* - [F,L]
+RewriteCond %{REQUEST_URI} \.sql$
+RewriteRule .* - [F,L]
+
 # Force HTTPS (uncomment in production)
 RewriteCond %{HTTPS} off
 RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]