# ---------------------------------------------
# Force HTTPS
# Redirects all http:// traffic to https://
# ---------------------------------------------
RewriteEngine On

# Skip if already secure (IONOS sets HTTPS=on behind their proxy)
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]


# ---------------------------------------------
# Force www removal (paulfunke.com, not www.paulfunke.com)
# Comment this block out if you prefer www
# ---------------------------------------------
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,L]


# ---------------------------------------------
# Security headers
# ---------------------------------------------
<IfModule mod_headers.c>
    # Tell browsers to always use HTTPS for this domain (1 year)
    # NOTE: only enable once you're certain HTTPS works everywhere.
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Prevent the site being embedded in frames (clickjacking)
    Header always set X-Frame-Options "SAMEORIGIN"

    # Stop browsers guessing file types
    Header always set X-Content-Type-Options "nosniff"

    # Limit referrer info sent to other sites
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>


# ---------------------------------------------
# Caching — speeds up repeat visits
# ---------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On

    # HTML: don't cache long, so edits show up quickly
    ExpiresByType text/html "access plus 0 seconds"

    # Downloads (CV, flashcards): short cache so replacements appear
    ExpiresByType application/pdf "access plus 1 hour"
    ExpiresByType application/zip "access plus 1 hour"

    # Static assets
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
</IfModule>


# ---------------------------------------------
# Compression — smaller transfers
# ---------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>


# ---------------------------------------------
# Default page
# ---------------------------------------------
DirectoryIndex index.html


# ---------------------------------------------
# Stop directory listing (e.g. someone browsing /files/)
# ---------------------------------------------
Options -Indexes
