# Baco Beauty Hub — document root for subdomain / add-on domain
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS when behind proxy / cPanel SSL
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{HTTP_HOST} bacobeautyhubcosmetics\.com$ [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Deny access to sensitive patterns if docroot is mis-pointed
  RewriteRule ^(config|includes|storage|sql|docs|mobile|brand-assets)/ - [F,L]

  # Front controller for pretty URLs (storefront)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !^/admin
  RewriteCond %{REQUEST_URI} !^/api
  RewriteRule ^ index.php [L,QSA]
</IfModule>

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
