# Disable directory browsing
Options -Indexes

# Private backend directories. Only api/ is meant to be reachable over the web;
# everything else here holds config, credentials, logs, session state and the
# command queues. The live host already denies these, but that is host policy,
# not ours - deny them explicitly so the rule ships with every deploy.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(includes|data|logs|queues)(/|$) - [F,L]
</IfModule>

# Prevent access to sensitive files
# Both Apache 2.2 and 2.4 syntax are given. A bare "Order/Deny" is a fatal
# "Invalid command" on a server without mod_access_compat, which would turn the
# whole site into HTTP 500 - the guard below makes that impossible.
<FilesMatch "\.(log|txt|bak|sql|ini|conf|env|json|lock|md|sh|cjs|yml|yaml)$">
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>