Options +FollowSymlinks
RewriteEngine On

# Options +FollowSymlinks
# RewriteEngine On

RewriteCond %{HTTPS} !=on

Header unset X-Powered-By

Options -Indexes

# deal with admin first
RewriteCond %{REQUEST_URI} ^/e-penalty/site/(admin)
RewriteRule ^admin/assets/(.*)$ backend/web/assets/$1 [L]
RewriteRule ^admin/css/(.*)$ backend/web/css/$1 [L]
RewriteRule ^admin/js/(.*)$ backend/web/js/$1 [L]
RewriteRule ^admin/theme/(.*)$ backend/web/theme/$1 [L]
RewriteRule ^admin/upload/(.*)$ backend/web/upload/$1 [L]
RewriteRule ^admin/fonts/(.*)$ backend/web/fonts/$1 [L]
RewriteRule ^admin/admin/(.*)$ backend/web/admin/$1 [L]
RewriteRule ^admin/adminassets/(.*)$ backend/web/adminassets/$1 [L]

RewriteCond %{REQUEST_URI} !^/e-penalty/backend/web/(assets|css|js|theme|upload|admin|adminassets)/
RewriteCond %{REQUEST_URI} ^/e-penalty/(admin)
RewriteRule ^.*$ backend/web/index.php [L]

#frontend
# RewriteCond %{REQUEST_URI} ^/e-penalty/?$
RewriteRule ^$ /e-penalty/site/challan-list [L,R=301]
RewriteCond %{REQUEST_URI} ^/e-penalty/(assets|css|theme|js|upload_doc)
RewriteRule ^assets/(.*)$ frontend/web/assets/$1 [L]
RewriteRule ^upload/(.*)$ frontend/web/upload/$1 [L]
RewriteRule ^css/(.*)$ frontend/web/css/$1 [L]
RewriteRule ^js/(.*)$ frontend/web/js/$1 [L]
RewriteRule ^theme/(.*)$ frontend/web/theme/$1 [L]
RewriteRule ^upload_doc/(.*)$ frontend/web/upload_doc/$1 [L]

RewriteCond %{REQUEST_URI} !^/e-penalty/(frontend|backend)/web/(assets|css|js|theme|upload|upload_doc)/
RewriteCond %{REQUEST_URI} !index.php
RewriteCond %{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.*$ frontend/web/index.php



<IfModule mod_headers.c>

	
    # Strict Transport Security (HSTS)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Content Security Policy (CSP)
   # Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"

    # X-XSS-Protection
    Header always set X-XSS-Protection "1; mode=block"

    # X-Frame-Options
    Header always set X-Frame-Options "SAMEORIGIN"

    # X-Content-Type-Options
    Header always set X-Content-Type-Options "nosniff"
</IfModule>