# Block direct access to sensitive files and directories

<FilesMatch "(^\.|composer\.|Dockerfile|Makefile|package\.json|phpunit\.xml)">

Require all denied

</FilesMatch>

# Specifically deny access to common backend/dev files

<FilesMatch "\.(log|sql|json|env|sh|bak|swp|txt|yml|yaml)$">

Require all denied

</FilesMatch>

# Block common malicious user agents and referrers

SetEnvIfNoCase User-Agent "(.shodan|zgrab|nmap|nikto|hydra|acunetix|nessus)" bad_bot

Deny from env=bad_bot

# Prevent directory listings

Options -Indexes

# Enforce secure HTTP headers

<IfModule mod_headers.c>

# Strict-Transport-Security (HSTS) - Forcing HTTPS

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

# X-Frame-Options - Prevents Clickjacking

Header always set X-Frame-Options "SAMEORIGIN"

# X-Content-Type-Options - Prevents MIME-sniffing

Header always set X-Content-Type-Options "nosniff"

# Referrer-Policy - Controls referrer information

Header always set Referrer-Policy "no-referrer-when-downgrade"

# Permissions-Policy - Controls browser features (e.g., camera, microphone)

# Add or remove features as needed for your site

Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

</IfModule>

# Redirect HTTP to HTTPS for all requests

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

</IfModule>