# Bad Actor Detection - Apache Configuration Example
#
# Add these directives to your virtual host configuration or .htaccess
#
# For virtual host (/etc/apache2/sites-available/yoursite.conf):
#   Include this file or copy the relevant sections
#
# For .htaccess (requires AllowOverride All):
#   Copy the php_value lines to your .htaccess

# =============================================================================
# PHP Auto Prepend/Append for Bad Actor Detection
# =============================================================================

# Auto-include security check BEFORE every PHP script
php_value auto_prepend_file "/var/www/html/security/badactor_prepend.php"

# Auto-include honeypot links AFTER every PHP script (HTML output)
php_value auto_append_file "/var/www/html/security/badactor_append.php"

# =============================================================================
# Additional Security Headers
# =============================================================================

<IfModule mod_headers.c>
    # Prevent clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"

    # XSS Protection
    Header always set X-XSS-Protection "1; mode=block"

    # Prevent MIME type sniffing
    Header always set X-Content-Type-Options "nosniff"

    # Referrer Policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Content Security Policy (adjust as needed)
    # Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'"

    # Remove server version info
    Header unset Server
    Header always unset X-Powered-By
</IfModule>

# =============================================================================
# Block Common Attack Paths at Apache Level
# =============================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block access to hidden files and directories
    RewriteRule (^|/)\.(?!well-known/) - [F,L]

    # Block access to backup and source files
    RewriteRule \.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|old|orig)$ - [F,L]

    # Block WordPress-specific attacks (if not using WordPress)
    # RewriteRule ^wp-(admin|login|includes|content) - [F,L]
</IfModule>

# =============================================================================
# Protect Security Directory
# =============================================================================

<Directory "/var/www/html/security">
    # Only allow PHP to include these files, not direct web access
    <FilesMatch "\.(php|json)$">
        Require all denied
    </FilesMatch>

    # Allow README for documentation
    <FilesMatch "README\.md$">
        Require all granted
    </FilesMatch>
</Directory>

# =============================================================================
# Rate Limiting with mod_ratelimit (if available)
# =============================================================================

<IfModule mod_ratelimit.c>
    # Limit bandwidth to 1MB/s per connection (helps slow down scrapers)
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 1000
</IfModule>

# =============================================================================
# Example Virtual Host Configuration
# =============================================================================
#
# <VirtualHost *:443>
#     ServerName example.com
#     DocumentRoot /var/www/html
#
#     # SSL Configuration
#     SSLEngine on
#     SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
#     SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
#
#     # Bad Actor Detection
#     php_value auto_prepend_file "/var/www/html/security/badactor_prepend.php"
#     php_value auto_append_file "/var/www/html/security/badactor_append.php"
#
#     # Logging
#     ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
#     CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
#
#     <Directory /var/www/html>
#         AllowOverride All
#         Require all granted
#     </Directory>
# </VirtualHost>
