Options -Indexes
RewriteEngine On

# Block direct access to config
RewriteRule ^config/ - [F,L]
RewriteRule ^core/   - [F,L]
RewriteRule ^cron/   - [F,L]
RewriteRule ^jobs/   - [F,L]

# Route api/v2 requests
RewriteCond %{REQUEST_URI} ^/api/v2/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^api/v2/(.*)$ api/v2/index.php [QSA,L]

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Content-Security-Policy "default-src 'self' https: 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:;"
</IfModule>

# Deny direct access to sensitive files
<FilesMatch "\.(env|sql|log|sh|bak)$">
  Order Deny,Allow
  Deny from all
</FilesMatch>
