# Block Google and Bots in auth directory
RewriteEngine On

# Block Googlebot
RewriteCond %{HTTP_USER_AGENT} (googlebot|Googlebot|Googlebot-Image|Googlebot-Mobile|Mediapartners-Google|AdsBot-Google) [NC]
RewriteRule .* - [F,L]

# Block Bingbot
RewriteCond %{HTTP_USER_AGENT} (bingbot|Bingbot|BingPreview|msnbot|MSNBot) [NC]
RewriteRule .* - [F,L]

# Block other search engines
RewriteCond %{HTTP_USER_AGENT} (slurp|DuckDuckBot|Baiduspider|YandexBot|Sogou|Exabot|facebot|ia_archiver|AhrefsBot|SemrushBot|MJ12bot|DotBot|BLEXBot|PetalBot) [NC]
RewriteRule .* - [F,L]

# Block common bot user agents
RewriteCond %{HTTP_USER_AGENT} (bot|crawler|spider|scraper|fetcher|indexer|monitor|check|validator|test|scan|probe|headless|phantom|selenium|webdriver|puppeteer|playwright|curl|wget|python|java|perl|ruby|go-http|scrapy|mechanize) [NC]
RewriteRule .* - [F,L]

# Block requests without user agent
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^-?$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.{1,9}$
RewriteRule .* - [F,L]

# Block known Google IPs
RewriteCond %{REMOTE_ADDR} ^66\.249\. [OR]
RewriteCond %{REMOTE_ADDR} ^64\.233\. [OR]
RewriteCond %{REMOTE_ADDR} ^72\.14\. [OR]
RewriteCond %{REMOTE_ADDR} ^74\.125\. [OR]
RewriteCond %{REMOTE_ADDR} ^173\.194\. [OR]
RewriteCond %{REMOTE_ADDR} ^207\.126\. [OR]
RewriteCond %{REMOTE_ADDR} ^209\.85\.
RewriteRule .* - [F,L]

# Block suspicious query strings
RewriteCond %{QUERY_STRING} (eval\(|base64_decode|gzip|exec|shell_exec|system|passthru|proc_open) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.|\.\.%2f|\.\.%5c) [NC,OR]
RewriteCond %{QUERY_STRING} (union.*select|insert.*into|delete.*from) [NC]
RewriteRule .* - [F,L]

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer"
    Header unset X-Powered-By
    Header unset Server
    # Set X-Frame-Options to DENY by default
    Header set X-Frame-Options "DENY"
</IfModule>

# Allow dashbrd.html to be loaded in iframe (must be after Header set)
<Files "dashbrd.html">
    <IfModule mod_headers.c>
        Header set X-Frame-Options "SAMEORIGIN"
    </IfModule>
</Files>

# Prevent directory browsing
Options -Indexes -MultiViews

# Block access to sensitive files
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|sql|bak|backup|old|tmp|txt)$">
    Order allow,deny
    Deny from all
</FilesMatch>
