Options -Indexes

# Keep diagnostic endpoints out of search engines/caches.
<FilesMatch "^(status|health)\.php$">
    Header always set Cache-Control "no-store"
</FilesMatch>
DirectoryIndex index.php

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(?:database|includes)/ - [F,L,NC]
    RewriteRule ^(?:composer\.(json|lock)|README\.md|\.env.*)$ - [F,L,NC]
    RewriteRule ^uploads/backups/ - [F,L,NC]
</IfModule>

<FilesMatch "\.(env|ini|log|sql|bak|old|dist|example)$">
    Require all denied
</FilesMatch>
