Options -Indexes
DirectoryIndex index.php

RewriteEngine On

# Force HTTPS (2026-07-08 W2, security M2): redirect any plain-HTTP request to
# HTTPS so the session cookie is never sent in the clear.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

RewriteRule ^(app|storage|tests|lib|views)(/|$) - [F,L]

<FilesMatch "^(config|setup)\.">
    Require all denied
</FilesMatch>

<FilesMatch "\.(ini|log|sql|md)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # HSTS (2026-07-08 W2): 6-month max-age. Modest window for the pilot; raise
    # and add preload only once HTTPS is permanent across all subdomains.
    Header always set Strict-Transport-Security "max-age=15768000"
</IfModule>
