Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Never serve internal application code or state directories.
    RewriteRule ^(?:app|resources|storage|tools)(?:/|$) - [F,L,NC]

    # Never serve configuration, environment, backup or documentation files.
    RewriteRule ^config\.php$ - [F,L,NC]
    RewriteRule ^config\.example\.php$ - [F,L,NC]
    RewriteRule ^(?:\.env|README\.md|.*\.(?:log|sql|bak|old|orig|save|dist|ini))$ - [F,L,NC]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

<FilesMatch "^(?:config\.php|config\.example\.php|\.env|README\.md|.*\.(?:log|sql|bak|old|orig|save|dist|ini))$">
    Require all denied
</FilesMatch>
