# Enable mod_rewrite
RewriteEngine On

# Security headers
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"

# Cache static assets
<FilesMatch "\.(jpg|jpeg|png|gif|webp|svg|ico|css|js)$">
    # Cache for 30 days
    ExpiresActive On
    ExpiresByType image/jpeg "access plus 30 days"
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType image/gif "access plus 30 days"
    ExpiresByType image/webp "access plus 30 days"
    ExpiresByType image/svg+xml "access plus 30 days"
    ExpiresByType image/x-icon "access plus 30 days"
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    
    # Cache control
    Header set Cache-Control "public, max-age=2592000"
    
    # Enable compression
    <IfModule mod_deflate.c>
        SetOutputFilter DEFLATE
        SetEnvIfNoCase Request_URI \
            \.(?:gif|jpe?g|png)$ no-gzip dont-vary
        SetEnvIfNoCase Request_URI \
            \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
    </IfModule>
</FilesMatch>

# Cache API image proxy
<FilesMatch "^api/image\.php$">
    ExpiresActive On
    ExpiresDefault "access plus 1 day"
    Header set Cache-Control "public, max-age=86400"
</FilesMatch>

# Deny access to sensitive files
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|bak)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Deny access to sensitive files in data directory
<FilesMatch "^data/.*\.(db|sqlite|log|txt|bak)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Allow access to images in data directory
<FilesMatch "^data/images/.*\.(jpg|jpeg|png|gif|webp|svg|ico)$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

# PHP settings
<IfModule mod_php.c>
    php_value upload_max_filesize 100M
    php_value post_max_size 100M
    php_value memory_limit 512M
    php_value max_execution_time 300
</IfModule>