# Htag Consulting — migration WordPress → site statique
Options -Indexes -MultiViews
AddDefaultCharset UTF-8
ErrorDocument 404 /404.html

RewriteEngine On
RewriteBase /

# 1. Canonique : https + non-www
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^(.*)$ https://htag-consulting.fr/$1 [R=301,L]

# 2. Nettoyage WordPress : /index.php/… et ?et_blog
RewriteRule ^index\.php/(.*)$ /$1 [R=301,L,QSD]
RewriteCond %{QUERY_STRING} (^|&)et_blog(=|&|$)
RewriteRule ^(.*)$ /$1 [R=301,L,QSD]

# podcast : pas encore publié
RewriteRule ^podcast\/?$ / [R=302,L]

# 3. Anciennes pages → équivalent ou accueil
RewriteRule ^a-propos\/?$ /fabien-thibaut-management-transition-nouvelleaquitaine/ [R=301,L,QSD]
RewriteRule ^services\/?$ /ce-que-je-fais/ [R=301,L,QSD]
RewriteRule ^services\/conseil-strategie-entreprise\/?$ / [R=301,L,QSD]
RewriteRule ^services\/digital\/?$ / [R=301,L,QSD]
RewriteRule ^services\/management\/?$ / [R=301,L,QSD]
RewriteRule ^services\/management\/management-de-transition\/?$ /ce-que-je-fais/ [R=301,L,QSD]
RewriteRule ^services\/management-de-transition\/?$ /ce-que-je-fais/ [R=301,L,QSD]
RewriteRule ^services\/management\/audit-rh\/?$ / [R=301,L,QSD]
RewriteRule ^services\/management\/laudit-humain\/?$ / [R=301,L,QSD]
RewriteRule ^services\/management\/comment-se-deroule-une-mission\/?$ /ce-que-je-fais/ [R=301,L,QSD]
RewriteRule ^services\/marketing\/?$ / [R=301,L,QSD]
RewriteRule ^services\/marketing\/conseil-en-ux\/?$ / [R=301,L,QSD]
RewriteRule ^services\/marketing\/design-sprint\/?$ / [R=301,L,QSD]
RewriteRule ^services\/marketing\/direction-marketing-externalisee\/?$ / [R=301,L,QSD]
RewriteRule ^services\/recrutement\/?$ / [R=301,L,QSD]
RewriteRule ^services\/referencement-naturel-seo\/?$ / [R=301,L,QSD]
RewriteRule ^actualites(\/page\/[0-9]+)?\/?$ /blog/ [R=301,L,QSD]
RewriteRule ^author\/fabien(\/page\/[0-9]+)?\/?$ /blog/ [R=301,L,QSD]
RewriteRule ^category\/.*$ /blog/ [R=301,L,QSD]
RewriteRule ^(sitemap_index\.xml|llms\.txt)$ /sitemap.xml [R=301,L]
RewriteCond %{REQUEST_URI} !^/wp-content/uploads/
RewriteRule ^wp-(content|includes|admin|json)(\/.*)?$ / [R=301,L]
RewriteRule ^(feed|comments\/feed|tag)(\/.*)?$ /blog/ [R=301,L]

# 4. URL propres : /page/ ← page.html
# a) les .html tapés directement sont redirigés vers l'URL propre
RewriteCond %{THE_REQUEST} \s/+(?:articles/)?([a-z0-9-]+(?:/[a-z0-9-]+)?)\.html[\s?] [NC]
RewriteRule ^ /%1/ [R=301,L]
RewriteRule ^index\.html$ / [R=301,L]

# b) /resultats/slug/ → resultats/slug.html
RewriteRule ^resultats/([a-z0-9-]+)/?$ resultats/$1.html [L]

# c) /page/ → page.html si le fichier existe à la racine
RewriteCond %{REQUEST_URI} !^/api/
RewriteCond %{DOCUMENT_ROOT}/$1.html -f
RewriteRule ^([a-z0-9-]+)/?$ $1.html [L]

# d) /slug/ → articles/slug.html (anciennes actus, URL conservée)
RewriteCond %{DOCUMENT_ROOT}/articles/$1.html -f
RewriteRule ^([a-z0-9-]+)/?$ articles/$1.html [L]

# e) repli si DOCUMENT_ROOT n'est pas résolu par l'hébergeur : on tente sans condition
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/(api|resultats|articles|img|wp-content)/
RewriteRule ^([a-z0-9-]+)/?$ $1.html [L]

# 5. En-têtes de sécurité
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  # CSP adaptée au site : Google Fonts, images wp-content, scripts/styles inline (header, formulaire, JSON-LD), envoi du formulaire vers /api/
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://htag-consulting.fr; connect-src 'self'; form-action 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; upgrade-insecure-requests"
  Header unset X-Powered-By
  Header unset Server
</IfModule>
ServerSignature Off

# Fichiers sensibles : jamais servis
<FilesMatch "^(\.htaccess|\.htpasswd|\.env|\.git.*|.*\.(bak|old|orig|sql|log|md|json)|A-SUPPRIMER.*)$">
  Require all denied
</FilesMatch>

# 6. Cache & compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
</IfModule>