RewriteEngine On

# Allow access to the /api/ endpoint while keeping the rest restricted
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Allow access to /api/ endpoint (replace '/api/' with your actual API endpoint)
    RewriteCond %{REQUEST_URI} ^/api/
    RewriteRule ^ - [L]
</IfModule>

# Disable directory browsing
Options -Indexes

# Deny access to sensitive files
<FilesMatch "\.(env|ini|log|sh|sql|bak|inc|db|sqlite)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security headers
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';
Header always set Referrer-Policy "no-referrer-when-downgrade"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
