// DO NOT use default password 'admin'
// Generate a strong password

// Option 1: Use PHP password hash
$password_hash = password_hash('YourStrongPassword123!@#', PASSWORD_BCRYPT);

// Then in the code:
if (password_verify($_POST['password'], $password_hash)) {
    // Allow login
}

// Option 2: Use simple password (less secure)
$password = 'UltraStr0ng_P@ssw0rd_2024!#%';

// Before the main code in fm.php, add:

// HTTP Basic Authentication
if (empty($_SERVER['PHP_AUTH_USER']) || empty($_SERVER['PHP_AUTH_PW'])) {
    header('WWW-Authenticate: Basic realm="File Manager"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Authentication required';
    exit;
}

// Set credentials (change these!)
$valid_user = 'admin';
$valid_pass = 'BasicAuth_P@ss123';

if ($_SERVER['PHP_AUTH_USER'] !== $valid_user || 
    $_SERVER['PHP_AUTH_PW'] !== $valid_pass) {
    header('HTTP/1.0 401 Unauthorized');
    echo 'Invalid credentials';
    exit;
}

// Continue with normal login flow...

// Add to fm.php before login check
$max_attempts = 5;
$lockout_time = 900; // 15 minutes

// Use memcache or file-based rate limiting
session_start();
if (isset($_SESSION['login_attempts'])) {
    if ($_SESSION['login_attempts'] >= $max_attempts) {
        if (time() - $_SESSION['last_attempt'] < $lockout_time) {
            exit('Too many login attempts. Try again later.');
        }
    }
}

// On failed login:
$_SESSION['login_attempts'] = ($_SESSION['login_attempts'] ?? 0) + 1;
$_SESSION['last_attempt'] = time();

// Option 1: Using password_hash (Recommended)
$password = 'YourStrongPassword123!@#';
$hashed = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

// Store hashed version in config
if (password_verify($_POST['password'], $hashed)) {
    $_SESSION['fm_logged_in'] = true;
}

// Option 2: Using SHA256 (Basic)
$password = 'YourStrongPassword123!@#';
$hashed = hash('sha256', $password);

if (hash('sha256', $_POST['password']) === $hashed) {
    $_SESSION['fm_logged_in'] = true;
}

// Option 3: Using .htpasswd (Apache)
# Generate .htpasswd file
htpasswd -c .htpasswd admin

# Use in .htaccess
<Files fm.php>
    AuthType Basic
    AuthName "File Manager"
    AuthUserFile /path/to/.htpasswd
    Require valid-user
</Files>

// Add password rotation reminder
$last_password_change = filemtime('fm.php');
$days_since_change = (time() - $last_password_change) / 86400;

if ($days_since_change > 90) {
    echo "⚠️ SECURITY: Consider changing password (last changed " . 
         floor($days_since_change) . " days ago)";
}

// At the very top of fm.php
if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] === 'off') {
    header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
    exit();
}

// Add HSTS header
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');

// Add to fm.php
header("Content-Security-Policy: default-src 'self'; script-src 'self' https://cdnjs.cloudflare.com; style-src 'self' https://fonts.googleapis.com");
header("X-Content-Type-Options: nosniff");
header("X-Frame-Options: SAMEORIGIN");
header("X-XSS-Protection: 1; mode=block");

// In fm.php
ini_set('log_errors', 1);
ini_set('error_log', '/path/to/fm_errors.log');

// Or in php.ini
[PHP]
log_errors = On
error_log = /var/log/php/fm_errors.log

// Add to fm.php
if (isset($_POST['password'])) {
    $log = date('Y-m-d H:i:s') . ' - Login attempt from ' . $_SERVER['REMOTE_ADDR'];
    
    if ($_POST['password'] === $password) {
        $log .= ' - SUCCESS';
        file_put_contents('fm_login.log', $log . "\n", FILE_APPEND);
    } else {
        $log .= ' - FAILED';
        file_put_contents('fm_login.log', $log . "\n", FILE_APPEND);
    }
}

// Log all file operations
function log_operation($action, $file, $status) {
    $log = date('Y-m-d H:i:s') . " | " . 
           $_SERVER['REMOTE_ADDR'] . " | " . 
           $action . " | " . 
           $file . " | " . 
           $status . "\n";
    file_put_contents('fm_operations.log', $log, FILE_APPEND);
}

// Use: log_operation('UPLOAD', 'document.pdf', 'SUCCESS');