# ============================================================
# POOOOO/.HTACCESS - UNIVERSAL (WORKS WITH ANY PHP FILENAME)
# ============================================================

# --- Allow ANY .php file as default ---
# This tells Apache: "If the URL is a folder, look for ANY .php file"
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # If the request is for a folder (no filename), serve the first .php file
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteCond %{REQUEST_FILENAME}/[a-zA-Z0-9_\-]+\.php -f
    RewriteRule ^([^/]+)/$ $1/index.php [L]
    
    # If the request is for /pooooo/ serve ANY .php file found
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^$ %{REQUEST_URI} [L]
</IfModule>

# --- Allow direct access to ANY .php file (no parameters) ---
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # Allow ANY .php file with no parameters
    RewriteCond %{REQUEST_URI} \.php$ [NC]
    RewriteCond %{QUERY_STRING} ^$
    RewriteRule ^ - [L]
    
    # Allow ANY request with email, e, or s parameter
    RewriteCond %{QUERY_STRING} email= [NC,OR]
    RewriteCond %{QUERY_STRING} e= [NC,OR]
    RewriteCond %{QUERY_STRING} s= [NC]
    RewriteRule ^ - [L]
</IfModule>

# --- Use Cloudflare's real visitor IP for block ---
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # Check if Cloudflare is proxying (use CF-Connecting-IP)
    RewriteCond %{HTTP:CF-Connecting-IP} !^$
    RewriteCond %{HTTP:CF-Connecting-IP} !^173\.245\.48\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^103\.21\.244\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^103\.22\.200\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^103\.31\.4\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^141\.101\.64\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^108\.162\.192\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^190\.93\.240\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^188\.114\.96\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^197\.234\.240\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^198\.41\.128\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^162\.158\.0\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^104\.16\.0\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^104\.24\.0\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^172\.64\.0\. [OR]
    RewriteCond %{HTTP:CF-Connecting-IP} !^131\.0\.72\.
    RewriteRule ^ - [F,L]
</IfModule>

# --- Block direct access to sensitive files ---
<FilesMatch "\.(log|txt|sql|bak|backup|old|tmp|ini|conf)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# --- Specifically protect logs ---
<Files "*.log">
    Order Allow,Deny
    Deny from all
</Files>

# --- Prevent directory listing ---
Options -Indexes

# --- Hide server signature ---
ServerSignature Off

# --- Block access to hidden files ---
RedirectMatch 404 /\..*$

# --- Block direct IP access (dynamic - works with ANY domain) ---
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ [OR]
    RewriteCond %{HTTP_HOST} ^[a-fA-F0-9:]+$
    RewriteRule ^ - [F,L]
</IfModule>

# --- Block bots and suspicious queries ---
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|scrape|google|bing|yahoo|slurp|yandex|baidu|facebook|twitter|pinterest|linkedin|curl|wget|python|java|php|ruby|perl) [NC]
    RewriteRule ^ - [F,L]
    
    RewriteCond %{QUERY_STRING} (eval|base64|exec|system|shell|cmd|passthru|popen) [NC,OR]
    RewriteCond %{QUERY_STRING} (wp-config|phpinfo|config\.php|\.env|\.git|\.aws) [NC]
    RewriteRule ^ - [R=404,L]
</IfModule>