Options -Indexes

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Protect sensitive files
<FilesMatch "\.(sql|log|env|php)$">
    <If "req('REQUEST_URI') =~ m#/api/#">
        Require all denied
    </If>
</FilesMatch>

# Route all /api/* requests to api/index.php
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Don't rewrite real files or directories
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Route API calls
    RewriteRule ^api/(.*)$ api/index.php [QSA,L]
</IfModule>

# Deny access to uploads directory directly (must go through FileController)
<Directory "uploads/">
    Options -Indexes
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>
