# UTIOM Assessment Toolkit — static hosting rules
# Place this file in the same directory as the tool HTML files.
# It stops WordPress from rewriting requests to this folder and sets
# sensible caching and security headers.

# --- Stop WordPress from intercepting this directory ---
<IfModule mod_rewrite.c>
  RewriteEngine Off
</IfModule>

DirectoryIndex index.html

# --- Security headers ---
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "no-referrer"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  # The tools have no backend. connect-src 'none' blocks any outbound call,
  # which is what makes the "answers stay in your browser" claim enforceable.
  Header always set Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'none'; form-action 'none'; base-uri 'none'; frame-ancestors 'self'"
</IfModule>

# --- Caching ---
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html "access plus 1 hour"
  ExpiresByType application/zip "access plus 7 days"
</IfModule>

# --- Compression ---
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript
</IfModule>

# --- Correct type for the download ---
AddType application/zip .zip

# --- Block dotfiles ---
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
