# ============================================================
# systems/.htaccess
# Blocks direct browser access to sensitive files and folders.
# ============================================================

# ---------- disable directory listing everywhere ----------
Options -Indexes

# ---------- block sensitive folders ----------
# Any request starting with data/, backups/, includes/, scripts/
# is rejected with 403.
RewriteEngine On
RewriteRule ^(data|backups|includes|scripts)/ - [F,L]

# ---------- block sensitive file types anywhere ----------
<FilesMatch "\.(db|sqlite|sqlite3|log|info|json|md|ini|env)$">
    Require all denied
</FilesMatch>

# ---------- fallback for Apache 2.2 ----------
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(db|sqlite|sqlite3|log|info|json|md|ini|env)$">
        Deny from all
    </FilesMatch>
</IfModule>

# ---------- tiny hardening ----------
# hide PHP version
<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ---------- block .htaccess and .git themselves ----------
<FilesMatch "^(\.htaccess|\.htpasswd|\.git.*)$">
    Require all denied
</FilesMatch>