# Upload beside index.html, at the domain root or inside your app subfolder.
# Apache 2.4 / cPanel: requires mod_rewrite and AllowOverride FileInfo.
DirectoryIndex index.html
Options -Indexes -MultiViews

RewriteEngine On

# Leave certificate validation requests alone.
RewriteRule ^\.well-known(?:/|$) - [L]

# Do not expose hidden files.
RewriteRule (^|/)\. - [F,L]

# Serve existing files and directories normally.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Missing assets must return 404, not the SPA HTML document.
RewriteRule ^assets(?:/|$) - [L]
RewriteRule \.(?:js|mjs|css|map|json|png|jpe?g|gif|svg|webp|avif|ico|woff2?|ttf|otf|txt|xml|pdf)$ - [L,NC]

# Relative target preserves the installation folder. No RewriteBase needed
# for ordinary cPanel directories under the domain document root.
RewriteRule ^ index.html [L]

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    <Files "index.html">
        Header set Cache-Control "no-cache"
    </Files>
</IfModule>
