DirectoryIndex index.php
Options -Indexes
ServerSignature Off
LimitRequestBody 262144000

<IfModule mod_rewrite.c>
RewriteEngine On

# Canonicalización genérica y compatible con instalaciones white-label.
RewriteCond %{HTTP_HOST} ^www\.([A-Za-z0-9.-]+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteCond %{HTTP_HOST} ^[A-Za-z0-9.-]+$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,NE]

RewriteRule ^\.well-known/security\.txt$ arena-security-txt.php [L]
RewriteRule ^robots\.txt$ arena-robots.php [L,QSA]
RewriteRule ^healthz$ arena-health-v190.php [L,QSA]
RewriteRule ^manifest\.webmanifest$ arena-manifest.php [L,QSA]
RewriteRule ^service-worker\.js$ service-worker.js [L,QSA]
RewriteRule ^\.well-known/arena-domain-verification\.txt$ arena-domain-verification.php [L,QSA]
RewriteRule ^sitemap\.xml$ arena-sitemap.php [L,QSA]
RewriteRule ^p/([a-z0-9-]+)/?$ arena-page.php?slug=$1 [L,QSA,NC]
RewriteRule ^f/([a-z0-9-]+)/([a-z0-9-]+)/?$ arena-funnel.php?slug=$1&step=$2 [L,QSA,NC]
RewriteRule ^f/([a-z0-9-]+)/?$ arena-funnel.php?slug=$1 [L,QSA,NC]

RewriteRule ^(?:app|database|resources|storage|tests|tools|docs|data|domain)/ - [F,L,NC]
RewriteRule ^install/.*\.php$ - [F,L,NC]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(self), geolocation=(self)"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Resource-Policy "same-origin"
</IfModule>

<FilesMatch "(?i)^(config(?:\.example)?\.php|INSTALLATION_ACCESS\.txt|SHA256SUMS\.txt|MANIFEST_SHA256\.txt|.*\.sql|.*\.log|.*\.md|.*\.json|composer\.(json|lock)|\.env)$">
Require all denied
</FilesMatch>
<FilesMatch "(?i)\.(bak|ini|sh|yml|yaml|dist)$">
Require all denied
</FilesMatch>

<Files "VERSION">
Require all denied
</Files>
