DirectoryIndex index.php index.html
Options -Indexes

<IfModule mod_rewrite.c>
RewriteEngine On

# Canonical HTTPS keeps authentication and payment tokens off plaintext links.
# 308 preserves POST bodies, unlike the old 301/302 login redirects.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !^https$ [NC]
RewriteCond %{HTTP:CF-Visitor} !"scheme":"https" [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=308,L,NE]

# Route an explicit /index.html request through the application so maintenance
# mode and the canonical landing-page decision cannot be bypassed.
RewriteRule ^index\.html$ index.php [L]
# Backward compatibility for older cached frontend HTML that requests /web/config.
RewriteRule ^web/config$ web/config.js [L]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "same-origin"
</IfModule>

<FilesMatch "(^\.|\.(env|ini|log|lock|sql|bak|dist|pem|key|conf)$)">
  Require all denied
</FilesMatch>

<Files "cron_guard.php">
  Require all denied
</Files>
