Options -Indexes
DirectoryIndex index.php login.php

# Deny direct access to includes and api from browser
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Redirect to login if not authenticated (handled by PHP, not .htaccess)
  # Block direct access to includes directory
  RewriteRule ^includes/ - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-XSS-Protection "1; mode=block"
</IfModule>

# Deny access to sensitive files
<FilesMatch "\.(sql|log|env|md)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# PHP settings
<IfModule mod_php.c>
  php_flag display_errors Off
  php_flag log_errors On
</IfModule>
