# Protection d'accès : à activer via cPanel > Directory Privacy (crée AuthUserFile).
Options -Indexes
Header always set X-Robots-Tag "noindex, nofollow"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "no-referrer"

# Forcer HTTPS
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Transmettre l'utilisateur authentifié à PHP
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
