<IfModule mod_headers.c>
    # 1. HSTS (Obliga a usar HTTPS por 1 año)
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # 2. X-Frame-Options (Permite que su propia web use marcos si lo requiere)
    Header set X-Frame-Options "SAMEORIGIN"

    # 3. X-Content-Type-Options (Previene la ejecución de archivos falsos)
    Header set X-Content-Type-Options "nosniff"

    # 4. Referrer-Policy (Protege la privacidad de origen)
    Header set Referrer-Policy "strict-origin-when-cross-origin"

    # 5. Permissions-Policy (Apaga funciones de hardware que su web estática no necesita)
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"

    # 6. CSP Optimizada al 100% (Limpieza final de fuentes)
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://code.jquery.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://use.fontawesome.com https://fonts.googleapis.com https://*.muniportales.info https://muniportales.info https://*.muniportales.org https://muniportales.org; font-src 'self' data: https: *; img-src 'self' data: https://*.muniportales.info https://muniportales.info https://*.muniportales.org https://muniportales.org https://amazonaws.com https://*.amazonaws.com; frame-src 'self' https://*.muniportales.info https://muniportales.info https://*.muniportales.org https://muniportales.org https://amazonaws.com https://*.amazonaws.com https://*.youtube.com;"
</IfModule>
