Options -Indexes
ServerSignature Off

# Block direct access to sensitive file types anywhere under public_html
<FilesMatch "\.(sql|log|env|md)$">
    Require all denied
</FilesMatch>

# Never allow the uploads folder to execute PHP (defense in depth if a bad file gets through validation)
<IfModule mod_php.c>
    <Directory "uploads">
        php_flag engine off
    </Directory>
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS (uncomment once your SSL cert is active)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
