# Kardağ Elektrik · PHP 8.5 + MySQL · Apache 2.4 (cPanel / Plesk)
DirectoryIndex index.html
Options -Indexes
AddDefaultCharset utf-8

<IfModule mod_rewrite.c>
  RewriteEngine On
  # HTTPS'e yönlendir
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  # Uygulama klasörlerine dışarıdan erişim yok
  RewriteRule ^(app|storage|install/data)(/|$) - [F,L]
  # Eski PlatinMarket adresleri (…-pmu123 / …-pmk45) → yeni sayfa (301)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.+-pm[uk]\d+/?)$ r.php?p=$1 [L,QSA]
</IfModule>

# Gizli ve gereksiz dosyalar
<FilesMatch "^(\.ht|\.env|composer\.|.*\.(md|log|bak|sql|lock|ini|sh|zpl)$)">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  # Müşteri sunumu sırasında arama motorları listelemesin. Canlı alan adına geçince bu satırı silin.
  Header set X-Robots-Tag "noindex, nofollow"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self \"https://www.paytr.com\")"
  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://connect.facebook.net https://code.jivosite.com https://cdnjs.cloudflare.com https://www.paytr.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com https://*.facebook.com https://api.openai.com https://*.jivosite.com wss://*.jivosite.com; frame-src https://*.jivosite.com https://www.googletagmanager.com https://www.paytr.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; object-src 'none'"
  <FilesMatch "\.(html|php)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
  <FilesMatch "\.(css|js|svg|png|jpg|jpeg|webp|woff2)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# PHP ayarları (hosting izin veriyorsa)
<IfModule mod_php.c>
  php_value upload_max_filesize 20M
  php_value post_max_size 40M
  php_value memory_limit 256M
  php_flag display_errors Off
  php_flag session.cookie_httponly On
</IfModule>
