# ForexSignalz — Apache config for the static site.
# Only used on Apache hosts (cPanel, shared hosting, LAMP boxes).
# Netlify / GitHub Pages / Cloudflare Pages ignore this file — they serve
# 404.html automatically because of its filename.

# ── Custom error page ─────────────────────────────────────────
# Path is absolute from the document root. If you deploy the site into a
# subdirectory (e.g. /signals/), change this to /signals/404.html.
ErrorDocument 404 /404.html

DirectoryIndex index.html

# Don't list directory contents when there's no index file.
Options -Indexes

AddDefaultCharset UTF-8

# ── Redirect www → apex and force HTTPS ───────────────────────
# Uncomment once the domain has a valid certificate. Skip both rules if your
# host already terminates TLS and redirects in front of Apache — otherwise you
# can end up in a redirect loop.
# <IfModule mod_rewrite.c>
#   RewriteEngine On
#   RewriteCond %{HTTPS} off
#   RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
#   RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
#   RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
# </IfModule>

# ── Compression ───────────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/plain
  AddOutputFilterByType DEFLATE application/javascript text/javascript
  AddOutputFilterByType DEFLATE image/svg+xml application/json
</IfModule>

# ── Caching ───────────────────────────────────────────────────
# HTML stays fresh so edits go live immediately; assets are cached hard.
# style.css is cached for a week — bump it to style.css?v=2 in the HTML if you
# need a change to land for returning visitors sooner than that.
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault                      "access plus 1 week"
  ExpiresByType text/html             "access plus 0 seconds"
  ExpiresByType text/css              "access plus 1 week"
  ExpiresByType image/svg+xml         "access plus 1 month"
  ExpiresByType image/x-icon          "access plus 1 month"
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "\.html$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>

  # ── Security headers ────────────────────────────────────────
  Header set X-Content-Type-Options "nosniff"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
</IfModule>

# ── Hide dotfiles (.htaccess, .gitignore, .git/) from the web ─
<IfModule mod_authz_core.c>
  <FilesMatch "^\.">
    Require all denied
  </FilesMatch>
</IfModule>

RedirectMatch 404 /\.git