Options -Indexes -MultiViews
Require all granted
DirectoryIndex index.php

# Secrets, configuration, source maps, database exports and archives are never public.
<FilesMatch "(?i)^(?:\..*|(?:composer|package)(?:-lock)?\.json|.*\.(?:env|ini|log|sql|bak|backup|old|orig|save|swp|zip|gz|tgz|tar|7z|rar|md|lock|map|yml|yaml|toml)(?:\..*)?|.*~)$">
 Require all denied
</FilesMatch>
<IfModule mod_rewrite.c>
 RewriteEngine On
 # Keep ACME certificate validation available, block all other dot paths.
 RewriteRule (^|/)\.(?!well-known/acme-challenge/)[^/]*(?:/|$) - [F,L,NC]
 RewriteRule ^(?:private|app|system|vendor|writable|php|integration-source|tests|tools|docs|deployment|frontend|node_modules|releases|backups)(?:/|$) - [F,L,NC]
 # Only the front controller may execute PHP from the public directory.
 RewriteRule ^(?!index\.php(?:/|$)).*\.(?:php[0-9]?|phtml|phar|cgi|pl)(?:/|$) - [F,L,NC]
 RewriteCond %{HTTP:Authorization} .
 RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteRule ^(.*)$ index.php/$1 [L,QSA]
</IfModule>
<IfModule mod_headers.c>
 <FilesMatch "(?i)\.(?:js|css|png|jpg|jpeg|webp|svg|woff2)$">
  Header set Cache-Control "public, max-age=3600"
 </FilesMatch>
 <FilesMatch "(?:-[A-Za-z0-9_-]{8,}\.(?:js|css)|[a-f0-9]{48}\.png)$">
  Header set Cache-Control "public, max-age=31536000, immutable"
 </FilesMatch>
 <FilesMatch "^(?:index\.php|app\.html|index\.html)$">
  Header set Cache-Control "no-store"
 </FilesMatch>
 Header always set X-Content-Type-Options "nosniff"
 Header always set Referrer-Policy "no-referrer"
</IfModule>
ServerSignature Off
