DirectoryIndex index.php
Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule "(^|/)\.(?!well-known/)" - [F,L]
  RewriteRule ^(?:app|bin|config|database|database_updates|docs|includes|storage)(?:/|$) - [F,L,NC]
</IfModule>

<FilesMatch "(?i)\.(sql|log|md|txt|json|ya?ml|ini|env|bak|old|orig|dist|zip|tar|gz|7z)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
</IfModule>
