Options -Indexes
ServerSignature Off

# Pretty API routes: /api/v1/orders -> /api/v1/index.php?r=orders
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api/v1/(.*)$ api/v1/index.php?r=$1 [QSA,L]

# Block access to dotfiles (.env, .git, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Never serve raw config/class source if someone points a vhost wrong
<FilesMatch "\.(sql|md|log)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
