/home/secapita/fh.secapital.co.ke
<IfModule mod_rewrite.c>
<IfModule mod_negotiation.c>
Options -MultiViews -Indexes
</IfModule>
RewriteEngine On
# Block unauthorized redirections on the login page
RewriteCond %{REQUEST_URI} ^/login$ [NC] # Match the login page URL
RewriteCond %{QUERY_STRING} envato\.appbusket\.com [NC,OR] # Block query strings referencing envato.appbusket.com
RewriteCond %{HTTP_REFERER} envato\.appbusket\.com [NC,OR] # Block referrers referencing envato.appbusket.com
RewriteCond %{THE_REQUEST} envato\.appbusket\.com [NC] # Block requests containing envato.appbusket.com
RewriteRule ^ - [F,L] # Forbid access if any condition matches
# Block direct access to license.js
RewriteCond %{QUERY_STRING} license\.js [NC]
RewriteRule ^ - [F,L]
# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
# Redirect Trailing Slashes If Not A Folder...
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [L,R=301]
# Send Requests To Front Controller...
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
</IfModule>
# Add Content Security Policy (CSP) ONLY for the login page
<IfModule mod_headers.c>
<Files "login">
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' https://trusted-cdn.com;"
Header always set Referrer-Policy "no-referrer"
</Files>
</IfModule>
# Prevent directory listing
Options -Indexes
# Prevent access to sensitive files
<FilesMatch "\.(htaccess|ini|log|conf)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit