# Hotels In Sariska — GoDaddy Linux shared hosting friendly rules

Options -Indexes
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS (enable after your SSL certificate is active)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # Clean URLs: /resorts -> /resorts.php  (also works for /resorts/<slug>)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^([^.]+?)/?$ $1.php [L]
</IfModule>

# Block direct access to configuration and includes
<FilesMatch "^(config\.php|mailer\.php)$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(ini|log|sql|bak|env)$">
  Require all denied
</FilesMatch>

# Security headers (safe defaults)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json image/svg+xml
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 6 months"
  ExpiresByType image/png "access plus 6 months"
  ExpiresByType image/webp "access plus 6 months"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType text/html "access plus 1 hour"
</IfModule>

ErrorDocument 404 /index.php
