# Greenlight Universal Agency – greenlightagency.co.tz
# If the server already has an .htaccess (e.g. cPanel/PHP handler lines),
# merge these rules into it rather than replacing it.

RewriteEngine On

# 1. Canonical domain: force HTTPS and non-www (fixes the duplicate-URL errors)
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://greenlightagency.co.tz%{REQUEST_URI} [L,R=301]

# 2. /index.html -> /
RewriteCond %{THE_REQUEST} \s/+index\.html[\s?] [NC]
RewriteRule ^index\.html$ / [L,R=301]

# 3. Never serve secrets, source or working files
<FilesMatch "^\.env">
    Require all denied
</FilesMatch>
<FilesMatch "\.(docx|md|py)$">
    Require all denied
</FilesMatch>
RedirectMatch 404 ^/(_template|tools|lib)(/|$)

# 4. Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml text/xml application/xml
</IfModule>

# 5. Browser caching
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/html "access plus 0 seconds"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType image/jpeg "access plus 6 months"
    ExpiresByType image/png "access plus 6 months"
    ExpiresByType image/webp "access plus 6 months"
    ExpiresByType image/svg+xml "access plus 6 months"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/ttf "access plus 1 year"
</IfModule>

# 6. HSTS – enable ONLY after HTTPS is confirmed working on both
#    greenlightagency.co.tz and www.greenlightagency.co.tz
# <IfModule mod_headers.c>
#     Header always set Strict-Transport-Security "max-age=31536000"
# </IfModule>
