# ============================================================
# Apache .htaccess - root of project
# Only directives valid inside .htaccess context.
# ============================================================

DirectoryIndex index.php
Options -Indexes

# Block direct download of dotfiles, backups, batch files, sql, etc.
<FilesMatch "^(\.|.*\.(env|bak|md|bat|sql|gitignore|log))$">
    Require all denied
</FilesMatch>

# Security headers (only if mod_headers is loaded - default in XAMPP)
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
