# ----------------------------------------------------------------------
# Compression — cuts text transfer substantially (measured ~139 KB saved).
# ----------------------------------------------------------------------
<IfModule mod_deflate.c>
	AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css
	AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml
	AddOutputFilterByType DEFLATE application/javascript application/x-javascript text/javascript
	AddOutputFilterByType DEFLATE application/json application/ld+json
	AddOutputFilterByType DEFLATE image/svg+xml font/woff2 font/woff application/vnd.ms-fontobject
</IfModule>

# ----------------------------------------------------------------------
# Cache policy — assets are versioned by file modification time, so they
# can be cached hard; HTML is never cached.
# ----------------------------------------------------------------------
<IfModule mod_expires.c>
	ExpiresActive On
	ExpiresDefault                          "access plus 1 month"
	ExpiresByType text/html                 "access plus 0 seconds"
	ExpiresByType text/css                  "access plus 1 year"
	ExpiresByType application/javascript    "access plus 1 year"
	ExpiresByType text/javascript           "access plus 1 year"
	ExpiresByType image/webp                "access plus 1 year"
	ExpiresByType image/avif                "access plus 1 year"
	ExpiresByType image/jpeg                "access plus 1 year"
	ExpiresByType image/png                 "access plus 1 year"
	ExpiresByType image/svg+xml             "access plus 1 year"
	ExpiresByType font/woff2                "access plus 1 year"
	ExpiresByType application/xml           "access plus 0 seconds"
</IfModule>

<IfModule mod_headers.c>
	<FilesMatch "\.(css|js|webp|avif|jpe?g|png|gif|svg|ico|woff2?)$">
		Header set Cache-Control "public, max-age=31536000, immutable"
	</FilesMatch>
	<FilesMatch "\.(html|php)$">
		Header set Cache-Control "no-cache, must-revalidate, max-age=0"
	</FilesMatch>

	# Baseline hardening.
	Header always set X-Content-Type-Options "nosniff"
	Header always set X-Frame-Options "SAMEORIGIN"
	Header always set Referrer-Policy "strict-origin-when-cross-origin"
	Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# ----------------------------------------------------------------------
# Block direct access to sensitive files.
# ----------------------------------------------------------------------
<FilesMatch "^(wp-config\.php|readme\.html|license\.txt|xmlrpc\.php)$">
	Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteRule ^wp-content/uploads/.*\.(php|phtml|php[0-9])$ - [F,L]
</IfModule>

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /erp-wordpress/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /erp-wordpress/index.php [L]
</IfModule>
# END WordPress
