# CryptoPayr White-Label — Apache configuration
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Keep the Authorization header for API calls (PHP-FPM / CGI drop it otherwise).
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Block private files and folders.
    RewriteRule ^(config\.php|install\.lock|cron\.php|composer\..*|README\.md)$ - [F,L]
    RewriteRule ^(app|views|uploads)(/|$) - [F,L]

    # Static assets are served directly; everything else goes to the front controller.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>

<FilesMatch "^(config\.php|install\.lock)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
