# ============================================
# LAYER 1: Bot/Crawler Blocking + Non-Windows Redirect
# ============================================

RewriteEngine On
# Production (domain root): RewriteBase /
# Local XAMPP under /Site/: RewriteBase /Site/
RewriteBase /

# --- Block known bot/crawler User-Agents (hard 403) ---
RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|slurp|yahoo|bing|baidu|yandex|duckduck|semrush|ahrefs|mj12bot|dotbot|rogerbot|facebot|facebookexternalhit|twitterbot|linkedinbot|pinterest|whatsapp|telegrambot|discordbot|applebot|googlebot|google-inspectiontool|mediapartners|adsbot|apis-google|feedfetcher|google-read-aloud|duplex|favicon|lighthouse|pagespeed|petalbot|bytespider|bytedance|sogou|exabot|ia_archiver|archive\.org_bot|httrack|wget|curl|python|scrapy|httpx|httpie|postman|insomnia|java|perl|ruby|php|go-http|dart|axios|node-fetch|undici|libwww|lwp|mechanize|nutch|heritrix|larbin|netcraft|nmap|nikto|masscan|zgrab|censys|shodan|zoomeye|phantom|headless|puppeteer|playwright|selenium|webdriver|chromedriver|geckodriver|electron|nightmare|splash|rendertron|prerender|browserless|apify|scrapingbee|scrapfly|brightdata|oxylabs|smartproxy|zyte|diffbot|embedly|quora|slack|skype|viber|snapchat|tiktok|instagram|github|bitbucket|gitlab|jenkins|travis|circleci|github-actions|cloudflare|uptimerobot|pingdom|statuscake|newrelic|datadog|site24x7|monitis|gptbot|chatgpt|claude|anthropic|openai|bard|cohere|perplexity|ccbot|commoncrawl|amazonbot|apple-cloudkit|dataprovider|domain\s?re|netpeakbot|pandalytics|seostar|serpstat|majestic|moz\.com|megaindex|blexbot|woorank|gtmetrix|webpagetest|google\s?web\s?light) [NC,OR]
# --- Block empty User-Agents ---
RewriteCond %{HTTP_USER_AGENT} ^$ [NC]
RewriteRule .* - [F,L]

# --- Redirect non-Windows users to professional page ---
# (Skip if already on unsupported.php to avoid redirect loop; allow /assets/ loads)
RewriteCond %{REQUEST_URI} !unsupported\.php [NC]
RewriteCond %{REQUEST_URI} !/assets/ [NC]
RewriteCond %{HTTP_USER_AGENT} !Windows [NC]
RewriteRule . unsupported.php [R=302,L]

# --- Protect config & logs directories ---
RewriteRule ^config/ - [F,L]
RewriteRule ^logs/ - [F,L]
RewriteRule ^cache/ - [F,L]
RewriteRule ^includes/ - [F,L]

# --- Prevent directory listing ---
Options -Indexes

# --- Security headers ---
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# --- Disable server signature ---
ServerSignature Off
