<IfModule mod_rewrite.c>
  RewriteEngine On

  # Blokkeer TRACE & TRACK HTTP-methoden (beveiliging tegen XST-aanvallen)
  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
  RewriteRule .* - [F]

  # Vermijd oneindige redirects
  RewriteCond %{ENV:REDIRECT_STATUS} 200
  RewriteRule .* - [L]

  # SEO-vriendelijke URLs
  RewriteCond %{QUERY_STRING} _escaped_fragment_=(.*)
  RewriteRule ^index.php index.php?controller=pjFrontPublic&action=pjActionRouter&_escaped_fragment_=%1 [L,NC]

  # iFrame-communicatie toestaan
  RewriteRule ^authorize-iframe-communicator\.html$ index.php?controller=pjAuthorize&action=pjActionIframeCommunicator [L,NC,QSA]
</IfModule>

# Verberg directorylijst en servergegevens
Options -Indexes
ServerSignature Off

# Verberg X-Powered-By header voor beveiliging
<IfModule mod_headers.c>
  Header unset X-Powered-By
</IfModule>

# Stel PHP-sessie cookies alleen-lezen in
<IfModule php5_module>
  php_value session.cookie_httponly true
</IfModule>

# MIME types voor webfonts
<IfModule mod_mime.c>
  AddType application/vnd.ms-fontobject    .eot
  AddType application/x-font-opentype      .otf
  AddType image/svg+xml                    .svg
  AddType application/x-font-ttf           .ttf
  AddType application/font-woff            .woff
  AddType application/font-woff2           .woff2
</IfModule>

# Sta toegang toe tot webfonts vanaf alle domeinen
<FilesMatch "\.(?i)(ttf|otf|woff2?|eot|svg)$">
  <IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
  </IfModule>
</FilesMatch>

# Compressie voor betere snelheid
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html application/x-javascript text/css application/javascript text/javascript text/plain text/xml application/json application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/xml font/eot font/opentype font/otf image/svg+xml image/vnd.microsoft.icon
  <FilesMatch "\.(?i)(js|css)$">
    SetOutputFilter DEFLATE
  </FilesMatch>
</IfModule>

# 🚀 **iFrame-toegang toestaan op ALLE domeinen**
<IfModule mod_headers.c>
  # Verwijder X-Frame-Options als het eerder is ingesteld
  Header always unset X-Frame-Options

  # X-Frame-Options volledig uitschakelen zodat ALLE websites iFrames kunnen gebruiken
  Header always set X-Frame-Options "ALLOWALL"

  # Content Security Policy - iFrames toestaan op ALLE domeinen
  Header always set Content-Security-Policy "frame-ancestors *;"
</IfModule>
