# ============================================================
# sw.seo-manager.info – Shopware Hub: Performance & Sicherheit
# Migration WordPress -> statischer Shopware Hub
# ============================================================

AddDefaultCharset UTF-8
Options -Indexes
ServerSignature Off

# ---------- MIME-Typen ----------
<IfModule mod_mime.c>
  AddType font/woff2 .woff2
  AddType image/svg+xml .svg
  AddType application/manifest+json .webmanifest
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # ---------- 1) HTTPS erzwingen + www -> non-www (ein Hop) ----------
  RewriteCond %{HTTPS} !=on [OR]
  RewriteCond %{HTTP_HOST} ^www\. [NC]
  RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
  RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

  # ---------- 2) MIGRATION: WordPress -> statisch ----------
  # /noexit, /impressum, /datenschutz behalten ihre URLs (Slash-Regel unten genuegt).
  # 2a) Plugin-ZIPs: alte Upload-Pfade -> /download/ (Dateiname NoExit vereinheitlicht)
  RewriteRule ^wp-content/uploads/2025/01/matomo_plugin_sw\.zip$ /download/matomo_plugin_sw.zip [R=301,L,NE]
  RewriteRule ^wp-content/uploads/2025/01/ExitPopup_Corrected_1\.zip$ /download/noexit_plugin_sw.zip [R=301,L,NE]
  # Fallback: sonstige alte ZIP-Links auf die Download-Uebersicht
  RewriteRule ^wp-content/uploads/.+\.zip$ /downloads [R=301,L]
  # 2b) WordPress-Reste endgueltig entfernen (410 Gone, Daten gesichert)
  RewriteRule ^(wp-content|wp-includes|wp-admin|wp-json)(/|$) - [G,L]
  RewriteRule ^(xmlrpc\.php|wp-login\.php|wp-cron\.php)$ - [G,L]
  RewriteRule ^(feed|comments/feed)(/|$) - [G,L]
  # 2c) WP-Suche/Archive -> Startseite (Verzeichnis ersetzt sie)
  RewriteCond %{QUERY_STRING} (^|&)s= [NC]
  RewriteRule ^$ /? [R=301,L]
  RewriteRule ^(category|tag|author|page)/ / [R=301,L]

  # ---------- 3) Saubere URLs ohne .html ----------
  # /index.html und /index -> /
  RewriteCond %{THE_REQUEST} \s/+index(\.html)?[\s?]
  RewriteRule ^ / [R=301,L]

  # Extern aufgerufene .html-URLs -> ohne Endung (301)
  RewriteCond %{THE_REQUEST} \s/+([^\s?]+)\.html[\s?]
  RewriteRule ^ /%1 [R=301,L,NE]

  # Trailing Slash entfernen (ausser bei echten Verzeichnissen)
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.+)/$ /$1 [R=301,L]

  # Intern: /begriff -> begriff.html ausliefern
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}.html -f
  RewriteRule ^([^.]+)$ $1.html [L]
</IfModule>

ErrorDocument 404 /404.html

# ---------- Security-Header ----------
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()"
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://statistik-online.org; connect-src 'self' https://statistik-online.org; img-src 'self' data: https://statistik-online.org; style-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"

  # Assets: 1 Jahr, immutable (Cache-Busting via ?v= im Build)
  <FilesMatch "\.(css|js|woff2|svg|png|ico|webp|jpg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  # HTML: kurz cachen, damit Updates schnell greifen
  <FilesMatch "\.html$">
    Header set Cache-Control "public, max-age=3600"
  </FilesMatch>
</IfModule>

# ---------- Caching (mod_expires als Fallback) ----------
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html "access plus 1 hour"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresByType application/manifest+json "access plus 1 week"
  ExpiresByType application/xml "access plus 1 day"
  ExpiresByType text/plain "access plus 1 day"
</IfModule>

# ---------- Kompression ----------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/plain application/javascript application/json application/xml application/manifest+json image/svg+xml
</IfModule>
<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/css text/plain application/javascript application/json application/xml application/manifest+json image/svg+xml
</IfModule>

# ---------- Quellcode & versteckte Dateien schuetzen ----------
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
<FilesMatch "\.(json|py|md|ttf)$">
  Require all denied
</FilesMatch>
