RewriteEngine On
RewriteCond %{ENV:HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


# BEGIN sec2-bak (2026-11-05) : copies de sauvegarde (.bak, .orig, .old, .save, .swp, *.bak-*, *.php.bak*) jamais servies
<FilesMatch "(?i)(\.(bak|orig|old|save|swp)$|\.bak-|\.php\.bak)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>
# END sec2-bak
