# Prevent caching of the dashboard HTML so the latest upload always shows
<IfModule mod_headers.c>
  <FilesMatch "\.html$">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
    Header set Pragma "no-cache"
    Header set Expires "0"
  </FilesMatch>
</IfModule>

# MIS login (Phase 2): index.php is the only entry point now
DirectoryIndex index.php

# dashboard.html holds the real app and must only ever be served through index.php's
# session check. index.html was the old unauthenticated entry — block it too so it
# can't be hit directly and bypass the login. config.php holds server secrets.
<FilesMatch "^(dashboard\.html|index\.html|config\.php)$">
  Require all denied
</FilesMatch>