<?php
 
require_once __DIR__ . '/../engine/core/index.php';

$config = include __DIR__ . '/../engine/core/config.php';

// Security headers
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; font-src \'self\';');
header_remove('X-Powered-By');

// Block direct access to content files
$requestUri = $_SERVER['REQUEST_URI'] ?? '';
if (strpos($requestUri, '/content/') !== false) {
    http_response_code(403);
    echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
    exit;
}

$cms = new CodePressCMS($config);
$cms->render();