# ---------------------------------------------------------------
# Root security rules
# ---------------------------------------------------------------

# Never list directory contents
Options -Indexes

# Block direct browser access to internal folders
RewriteEngine On
RewriteRule ^(config|includes|database)/ - [F,L]

# Basic security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Disable PHP execution inside the uploads folder (defense in depth
# against a malicious file being uploaded and then executed)
<Directory "uploads">
  <FilesMatch "\.(php|phtml|php\d)$">
    Require all denied
  </FilesMatch>
</Directory>
