Options -Indexes
Options +FollowSymLinks

# Prevent direct access to includes/
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^includes/ - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# PHP settings
<IfModule mod_php.c>
  php_value upload_max_filesize 20M
  php_value post_max_size 25M
  php_value max_execution_time 60
  php_value memory_limit 256M
</IfModule>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript application/json
</IfModule>

# Cache static assets
<IfModule mod_expires.c>
  ExpiresActive on
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/webp "access plus 1 month"
  ExpiresByType text/css "access plus 1 week"
  ExpiresByType application/javascript "access plus 1 week"
</IfModule>

# Deny access to sensitive files
<FilesMatch "\.(sql|env|log|sh)$">
  Order deny,allow
  Deny from all
</FilesMatch>
