# .htaccess SUPER ADMIN - PT Hadir Laris Teknologi
# Taruh di folder /public_html/super_admin/.htaccess

# 1. PROTEKSI PASSWORD BASIC AUTH
AuthType Basic
AuthName "Super Admin Hadir Laris - Restricted Area"
AuthUserFile /home/infe8543/.htpasswd
Require valid-user

# 2. BLOKIR AKSES LANGSUNG KE FILE SENSITIF
<FilesMatch "(\.env|\.git|config\.php|wp-config\.php|\.htpasswd)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 3. DISABLE DIRECTORY LISTING
Options -Indexes

# 4. PROTEKSI DARI SQL INJECTION & XSS (Basic)
<IfModule mod_rewrite.c>
RewriteEngine On

# Blokir user agent kosong (bot)
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]

# Blokir akses file .sql, .log, .zip di super admin
RewriteRule \.(sql|log|zip|env)$ - [F,L,NC]

# Force HTTPS untuk super admin
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# 5. SECURITY HEADERS
<IfModule mod_headers.c>
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# 6. BLOKIR IP LUAR INDONESIA (Opsional, aktifkan jika mau)
# Uncomment 3 baris di bawah kalau mau hanya IP Indonesia bisa akses
# <RequireAll>
#    Require ip 36.72.0.0/13 103.0.0.0/8 114.0.0.0/8
# </RequireAll>

# 7. LIMIT UPLOAD & EXECUTION
php_flag engine on
php_value upload_max_filesize 10M
php_value post_max_size 10M
# Matikan eksekusi PHP di folder upload jika ada
<FilesMatch "\.ph(p[345]?|tml)$">
    <If "%{REQUEST_URI} =~ m#/uploads/#">
        Require all denied
    </If>
</FilesMatch>

# 8. CUSTOM ERROR PAGE
ErrorDocument 401 "401 Unauthorized - Hubungi Admin PT Hadir Laris Teknologi"
ErrorDocument 403 "403 Forbidden - Akses Super Admin Ditolak"