Options -Indexes
ServerSignature Off

# Protect sensitive files by extension
<FilesMatch "\.(sql|md|log|env|json|lock)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect all dotfiles (.env, .htpasswd, .git, etc.)
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect hidden directories
RedirectMatch 404 /\.git
RedirectMatch 404 /\.sixth

# PHP error display off in production
php_flag display_errors Off
php_value error_log logs/php_error.log

# Default charset
AddDefaultCharset UTF-8
