RewriteEngine On
# No forzar HTTPS en entornos locales (Docker / pruebas). En producción
# (host real) sí se aplica el redirect como antes.
RewriteCond %{HTTP_HOST} !^localhost [NC]
RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Options -Indexes

RewriteBase /

ErrorDocument 403 https://%{HTTP_HOST}
ErrorDocument 404 https://%{HTTP_HOST}
ErrorDocument 400 https://%{HTTP_HOST}
ErrorDocument 500 https://%{HTTP_HOST}

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /error.php

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"

    # Content-Security-Policy (básica). Permite los CDNs que usa el sitio y el
    # panel. Se mantiene 'unsafe-inline'/'unsafe-eval' porque la app tiene mucho
    # script/estilo en línea y editores (CKEditor); endurecer con nonces requiere
    # refactor. Aun así limita orígenes, object-src y base-uri.
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com https://code.jquery.com https://cdn.jsdelivr.net https://cdn.ckeditor.com https://buttons.github.io https://cdnjs.cloudflare.com https://kit.fontawesome.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdnjs.cloudflare.com https://cdn.ckeditor.com; font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com https://cdn.ckeditor.com https://ka-f.fontawesome.com; img-src 'self' data: https:; connect-src 'self' https://www.google.com https://cdn.ckeditor.com https://cdnjs.cloudflare.com https://ka-f.fontawesome.com https://kit.fontawesome.com; frame-src 'self' https://www.google.com https://recaptcha.google.com; frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php80” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php80 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
