Client-Side URL Cleaner & WAF telah aktif! Skrip pada halaman ini secara automatik membuang /index.html atau .html pada bar alamat pelayar (History API) dan menapis parameter URL berbahaya (XSS/SQLi).
Untuk perlindungan penuh di peringkat pelayan (Server-Level WAF & RewriteEngine di cPanel / Apache / LiteSpeed), sila muat turun atau salin kod di bawah dan simpan sebagai fail bernama .htaccess di dalam folder public_html:
# ======================================================================
# THE CONCIERGE LANGKAWI - CLEAN URL (HIDE .HTML) & WAF PROTECTION LAYER
# ======================================================================
RewriteEngine On
Options -Indexes -MultiViews
ServerSignature Off
# 1. FORCE HTTPS (SSL)
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# 2. HIDE .HTML EXTENSION & REDIRECT /index.html TO ROOT (/)
RewriteCond %{THE_REQUEST} \s/+(.*/)?index\.html[\s?] [NC]
RewriteRule ^ /%1 [R=301,L]
RewriteCond %{THE_REQUEST} \s/+(.+?)\.html[\s?] [NC]
RewriteRule ^ /%1 [R=301,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.html -f
RewriteRule ^(.+?)/?$ $1.html [L]
# 3. WAF LAYER: BLOCK SQL INJECTION, XSS, PATH TRAVERSAL & CODE INJECTION
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\|%2e%2e) [NC,OR]
RewriteCond %{QUERY_STRING} (union.*select|insert.*into|drop.*table|concat\(|eval\(|base64_encode) [NC]
RewriteRule .* - [F,L]
# 4. WAF LAYER: BLOCK MALICIOUS SCANNERS & SCRAPER BOTS
RewriteCond %{HTTP_USER_AGENT} (sqlmap|nikto|nmap|masscan|acunetix|dirbuster|gobuster|havij|libwww-perl|python-requests) [NC]
RewriteRule .* - [F,L]
# 5. WAF SECURITY HEADERS
<IfModule mod_headers.c>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>
