# SGA HR — Apache rules (InMotion / cPanel)
Options -Indexes
DirectoryIndex index.php

# Always use HTTPS
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Never serve private folders or the config file directly
RewriteRule ^(inc|lib|storage|import)(/|$) - [F,L]
<FilesMatch "^(config\.php|.*\.(json|sql|md|log|txt))$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

# Allow uploads up to 20 MB (signed PDFs, ID documents)
<IfModule mod_php.c>
  php_value upload_max_filesize 20M
  php_value post_max_size 25M
</IfModule>
