Options -Indexes
DirectoryIndex index.php

<FilesMatch "^(db_config|auth|auth_common|system_common|occ_app_secrets.*)\.php$">
  Require all denied
</FilesMatch>

<FilesMatch "^(install_mysql|diagnostico_.*|sii_.*diag|sii_token_diag|backup_json|sii_test|health)\.php$">
  Require all denied
</FilesMatch>

<FilesMatch "\.(sql|db|sqlite|zip|bak|backup|old|tgz|tar|gz|7z|rar|log)$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always unset X-Powered-By
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set Cache-Control "no-store"
</IfModule>
