# Prevent direct access to certificate files
# PDFs/HTMLs must be downloaded through the admin interface via proper authorization checks

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Block direct browser access, only allow via admin download script
  RewriteCond %{HTTP_REFERER} !^https?://(localhost|127\.0\.0\.1|clients\.expertaims\.in) [NC]
  RewriteRule ^.*$ - [F]
</IfModule>

# Additional security headers
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "DENY"

# Deny script execution
php_flag engine off
<FilesMatch "\.(html|pdf)$">
  Allow from all
</FilesMatch>
