<IfModule mod_rewrite.c>
    RewriteEngine On
    # Kaabe: HTTPS only (secure cookies). Also enable "Force HTTPS Redirect" in cPanel → Domains.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
<IfModule mod_deflate.c>
    <filesMatch "\.(js|css|html|php)$">
        SetOutputFilter DEFLATE
    </filesMatch>
</IfModule>
# Kaabe POS: never serve dumps, logs, environment files or docs
<FilesMatch "\.(sql|gz|log|env|md)$">
    Require all denied
</FilesMatch>
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
    Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=()"
</IfModule>
