Options -Indexes -Includes -ExecCGI
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS outside local development.
    RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$ [NC]
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # Private application areas and legacy public storage must never be served.
    RewriteRule ^(?:app|lang|storage|tools|uploads|extracted)(?:/|$) - [F,L,NC]

    # Only the documented PHP entry points may execute.
    RewriteCond %{REQUEST_URI} !/(?:index|process|extract|download|dashboard|dashboard_auth|logout|password_reset|upload|save_comment)\.php$ [NC]
    RewriteRule \.php$ - [F,L,NC]

    # Block direct requests for internal state and backup/source files.
    RewriteRule (^|/)(?:\.storage-path|integrity-manifest\.json|config\.json|comments\.json)$ - [F,L,NC]
    RewriteRule ^(?:README|DEPLOYMENT|BUNDLED_ENGINE|SECURITY_AUDIT|HOSTING_NOTES)\.md$ - [F,L,NC]
    RewriteRule \.(?:json|log|lock|ini|env|sql|bak|old|orig|dist|yml|yaml)$ - [F,L,NC]
</IfModule>

<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
</IfModule>

<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

<FilesMatch "(^\.|\.(?:phtml|phar|php[3-8]|cgi|pl|py|sh)$)">
    Require all denied
</FilesMatch>

# Allow only the known PHP entry points.
<FilesMatch "^(?:index|process|extract|download|dashboard|dashboard_auth|logout|password_reset|upload|save_comment)\.php$">
    Require all granted
</FilesMatch>

LimitRequestBody 2147483648
ServerSignature Off
