diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..4a533cf
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,69 @@
+# ForexSignalz — Apache config for the static site.
+# Only used on Apache hosts (cPanel, shared hosting, LAMP boxes).
+# Netlify / GitHub Pages / Cloudflare Pages ignore this file — they serve
+# 404.html automatically because of its filename.
+
+# ── Custom error page ─────────────────────────────────────────
+# Path is absolute from the document root. If you deploy the site into a
+# subdirectory (e.g. /signals/), change this to /signals/404.html.
+ErrorDocument 404 /404.html
+
+DirectoryIndex index.html
+
+# Don't list directory contents when there's no index file.
+Options -Indexes
+
+AddDefaultCharset UTF-8
+
+# ── Redirect www → apex and force HTTPS ───────────────────────
+# Uncomment once the domain has a valid certificate. Skip both rules if your
+# host already terminates TLS and redirects in front of Apache — otherwise you
+# can end up in a redirect loop.
+#
+# RewriteEngine On
+# RewriteCond %{HTTPS} off
+# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+# RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
+# RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
+#
+
+# ── Compression ───────────────────────────────────────────────
+
+ AddOutputFilterByType DEFLATE text/html text/css text/plain
+ AddOutputFilterByType DEFLATE application/javascript text/javascript
+ AddOutputFilterByType DEFLATE image/svg+xml application/json
+
+
+# ── Caching ───────────────────────────────────────────────────
+# HTML stays fresh so edits go live immediately; assets are cached hard.
+# style.css is cached for a week — bump it to style.css?v=2 in the HTML if you
+# need a change to land for returning visitors sooner than that.
+
+ ExpiresActive On
+ ExpiresDefault "access plus 1 week"
+ ExpiresByType text/html "access plus 0 seconds"
+ ExpiresByType text/css "access plus 1 week"
+ ExpiresByType image/svg+xml "access plus 1 month"
+ ExpiresByType image/x-icon "access plus 1 month"
+
+
+
+
+ Header set Cache-Control "no-cache, must-revalidate"
+
+
+ # ── Security headers ────────────────────────────────────────
+ Header set X-Content-Type-Options "nosniff"
+ Header set Referrer-Policy "strict-origin-when-cross-origin"
+ Header set X-Frame-Options "SAMEORIGIN"
+ Header set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
+
+
+# ── Hide dotfiles (.htaccess, .gitignore, .git/) from the web ─
+
+
+ Require all denied
+
+
+
+RedirectMatch 404 /\.git
diff --git a/404.html b/404.html
new file mode 100644
index 0000000..b1d1281
--- /dev/null
+++ b/404.html
@@ -0,0 +1,80 @@
+
+
+
+ This page hit its stop. It may have been moved, renamed, or it never
+ existed — either way, there is nothing here. The engine is still scanning
+ and the channel is still posting.
+