.htaccess

# Deny access to sensitive files
<FilesMatch "^(\.env|setup\.php)$">
    Require all denied
</FilesMatch>

# Gzip compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json font/ttf font/woff font/woff2
</IfModule>

<IfModule mod_headers.c>
    # JS and HTML — always revalidate so code changes are visible immediately.
    # The script tag ?v= param busts the cache on intentional deploys.
    <FilesMatch "\.(js|html)$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    # JSON data files — same: revalidate on every request
    <FilesMatch "\.json$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    # CSS — revalidate (style changes need to show immediately too)
    <FilesMatch "\.css$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    # Fonts — truly immutable; safe to cache for 1 year
    <FilesMatch "\.(ttf|woff|woff2)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
</IfModule>