Options -Indexes
ServerSignature Off
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header unset X-Powered-By
</IfModule>
# Block direct access to internals
RedirectMatch 403 ^/?(.*/)?(config|includes|storage)(/|$)
<FilesMatch "\.(sql|log|lock|md|ini|env|bak)$">
  Require all denied
</FilesMatch>
