# Image folder: no script execution, no listing.
Options -Indexes
<FilesMatch "\.(php|phtml|phar|pl|py|cgi|sh)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

# Logo files never change under the same name (a new upload gets a new name),
# so browsers and CDNs may keep them for a year without re-checking.
<IfModule mod_mime.c>
  AddType image/avif .avif
  AddType image/webp .webp
</IfModule>
<IfModule mod_headers.c>
  <FilesMatch "\.(png|webp|avif|jpe?g|gif|svg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
    # Images are meant to be found: make sure no inherited header hides them from image search.
    Header unset X-Robots-Tag
    Header set X-Robots-Tag "index, follow, max-image-preview:large"
    # Lets other sites, apps and AI tools read the files (e.g. previews, image search tools).
    Header set Access-Control-Allow-Origin "*"
    Header set Timing-Allow-Origin "*"
  </FilesMatch>
  # Generated social images are re-made when a game changes; cache for a day.
  <FilesMatch "^(title|article|site)-\d+\.png$">
    Header set Cache-Control "public, max-age=86400"
  </FilesMatch>
</IfModule>
