Options -Indexes
ServerSignature Off

# Deny direct access to sensitive dirs
<FilesMatch "\.(env|sql|log|bak|sh|git)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Redirect to login if not logged in (handled by PHP)
    RewriteRule ^$  dashboard.php [L,R=302]

    # Block access to assets/inc and assets/lib
    RewriteRule ^assets/inc/ - [F,L]
    RewriteRule ^assets/lib/ - [F,L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
</IfModule>
