Options -Indexes -ExecCGI

# Force HTTPS — uncomment once SSL is active
# RewriteEngine On
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Block sensitive files
<FilesMatch "\.(env|log|json|lock|sql|bat|sh|md|gitignore|gitattributes|editorconfig|bak|swp|tmp|sqlite|yml|yaml|xml|ini|conf)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# Disable PHP info exposure
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag expose_php Off
</IfModule>
