# Prevent directory browsing
Options -Indexes

# Prevent displaying signatures on error pages
ServerSignature Off

# Block access to hidden files and directories (starting with a dot)
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Allow,Deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block access to backups, logs, composer configs, database files, migration scripts, test scripts, and utility script patches
<FilesMatch "(database\.sql|error\.log|composer\.(json|lock)|migrate_.*\.php|test_db.*\.php|add_settings\.php|update_.*\.php)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Allow,Deny
        Deny from all
    </IfModule>
</FilesMatch>

RewriteEngine On

# Redirect API calls to correct PHP files without extensions
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [NC,L]

# Basic security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>

