1#@!#!123s

: / home / diafrica / www /
Filename : .htaccess
back
# Set the default directory index files
DirectoryIndex index.php index.html index.htm

# Redirect graduates/ to the full URL
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Redirect non-HTTPS requests to HTTPS
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
    RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Serve PHP files without requiring .php in the URL
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^([^\.]+)$ $1.php [NC,L]

    # Ensure other static assets are not affected
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
</IfModule>

# Protect .htaccess and other hidden files
<IfModule mod_authz_core.c>
    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    <FilesMatch "^\.">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Deny access to php.ini and other sensitive files
<IfModule mod_authz_core.c>
    <FilesMatch "php.ini|wp-config.php|error_log">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    <FilesMatch "php.ini|wp-config.php|error_log">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

# Allow access to custom 403 error page
<IfModule mod_authz_core.c>
    <Files 403.shtml>
        Require all granted
    </Files>
</IfModule>
<IfModule !mod_authz_core.c>
    <Files 403.shtml>
        Order allow,deny
        Allow from all
    </Files>
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    # Allow embedding content from the same origin (allow iframe embedding)
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer-when-downgrade"
    
    # Enable CORS for PDF files to allow embedding
    <FilesMatch "\.pdf$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>

# Disable directory listing
Options -Indexes

# Disable execution of PHP and HTML files in specific folders like uploads, tmp, etc.
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_URI} ^/uploads/ [OR]
    RewriteCond %{REQUEST_URI} ^/tmp/ [OR]
    RewriteCond %{REQUEST_URI} ^/public/
    RewriteRule \.(php|php5|php7|phtml|html|htm)$ - [F,L]
</IfModule>
deny from 198.204.230.58

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php56” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php56 .php .php5 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit