DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(?:config|database|tools|storage)(?:/|$) - [F,L,NC]
</IfModule>

<FilesMatch "(?i)(?:^\.|error_log$|\.sql$|\.zip$|\.bak$|\.old$|\.log$|\.ini$|\.env$|\.md$)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(self), camera=(self), microphone=()"
</IfModule>
