# ==============================================================================
# AI Voice Receptionist - cPanel Apache Security Rules
# ==============================================================================

# Disable directory browsing
Options -Indexes

# Protect sensitive data files from direct web browser access
<FilesMatch "^(database\.sqlite|.*\.sqlite|.*\.db|call_logs\.json|receptionist_errors\.log|config\.php|\.env)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Protect temporary session folder
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^sessions/ - [F,L]
</IfModule>

# Security Headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Allow HTTP POST requests from Twilio webhooks to index.php
<Files "index.php">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</Files>
