Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # HostDesk clean URLs — safe when the panel lives inside any subfolder.
    # IMPORTANT: substitutions are relative (no leading slash), so Apache keeps
    # /whmcontrol/hostdesk-panel/public/ or any other installation prefix.

    # Redirect browser requests for index.php to the current directory URL.
    # THE_REQUEST prevents internal rewrites from causing redirect loops.
    RewriteCond %{THE_REQUEST} \s/+[^?\ ]*/index\.php(?:[?\ ]) [NC]
    RewriteRule ^index\.php$ ./ [R=301,L,NE]

    # reseller.php is the public reseller landing page. /reseller/ is the
    # authenticated reseller control panel, so expose the landing page as
    # /domain-reseller.
    RewriteCond %{THE_REQUEST} \s/+[^?\ ]*/reseller\.php(?:[?\ ]) [NC]
    RewriteRule ^reseller\.php$ domain-reseller [R=301,L,NE]

    # Redirect direct .php browser requests to the same relative clean URL.
    RewriteCond %{THE_REQUEST} \s/+[^?\ ]*\.php(?:[?\ ]) [NC]
    RewriteRule ^(.+)\.php$ $1 [R=301,L,NE]

    # Explicit public routes. These do not depend on REQUEST_FILENAME checks,
    # which makes them more reliable on cPanel/LiteSpeed subfolder installs.
    RewriteRule ^admin/?$ admin.php [L,QSA,NC]
    RewriteRule ^order/?$ order.php [L,QSA,NC]
    RewriteRule ^domain/?$ domain.php [L,QSA,NC]
    RewriteRule ^domain-pricing/?$ domain-pricing.php [L,QSA,NC]
    RewriteRule ^domain-reseller/?$ reseller.php [L,QSA,NC]
    RewriteRule ^health/?$ health.php [L,QSA,NC]
    RewriteRule ^install/?$ install.php [L,QSA,NC]
    RewriteRule ^upgrade/?$ upgrade.php [L,QSA,NC]
    RewriteRule ^repair-role/?$ repair_role.php [L,QSA,NC]
    RewriteRule ^update-v1\.3/?$ update_v1.3.php [L,QSA,NC]
    RewriteRule ^update-v1\.4/?$ update_v1.4.php [L,QSA,NC]
    RewriteRule ^api/reseller/?$ api/reseller.php [L,QSA,NC]

    # Generic fallback for future top-level PHP pages.
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI}.php -f [OR]
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^(.+?)/?$ $1.php [L,QSA]
</IfModule>

<FilesMatch "(?i)^(?:config\.php|config\.example\.php|README(?:-[^/]*)?\.md|SECURITY\.md|UPGRADE-[^/]+\.txt|\.env|\.user\.ini|composer\.(?:json|lock))$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# HostDesk v1.9 security hardening
ServerSignature Off
FileETag None
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} ^(?:TRACE|TRACK)$ [NC]
    RewriteRule .* - [F,L]
</IfModule>
<FilesMatch "(?i)(^\.|(?:~|\.swp|\.swo)$|\.(?:sql|sqlite|db|bak|backup|old|orig|save|tmp|temp|log|ini|env|dist|md|txt|json|xml|yml|yaml|lock|zip|rar|7z|tar|tgz|gz|bz2|xz|phar)$)">
    Require all denied
</FilesMatch>
<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
    Header always set X-Permitted-Cross-Domain-Policies "none"
</IfModule>
