# Prevent config.php from ever being served directly, even if the
# APP_BOOTSTRAP guard inside it were ever removed by mistake.
<Files "config.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

# Disable directory listing
Options -Indexes

# Basic security headers (safe to keep even if some are also set in PHP)
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "no-referrer-strict-origin-when-cross-origin"
</IfModule>

# Sensible default charset
AddDefaultCharset UTF-8
