# Trust Mail - Apache/LiteSpeed rules (cPanel)
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On
# Never serve dotfiles
RewriteRule (^|/)\.(?!well-known/) - [F]
# Serve real files (assets) directly, everything else goes to the stub
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_headers.c>
# Fingerprinted assets are immutable
<FilesMatch "\.(js|css|json|woff2|svg|png|wasm)$">
  Header set X-Content-Type-Options "nosniff"
</FilesMatch>
</IfModule>

# Only the stub may be executed from the web root (no other PHP file is ever served directly).
# NOTE: do not condition on REQUEST_URI here - rewritten requests keep their original URI.
<FilesMatch "^(?!index\.php$).*\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>
