# ######################################################################
# # SECURITY                                                           #
# ######################################################################

# ----------------------------------------------------------------------
# | Disable file indexing                                              |
# ----------------------------------------------------------------------

<IfModule mod_autoindex.c>
  Options -Indexes
</IfModule>

# ----------------------------------------------------------------------
# | Block access to hidden files                                       |
# ----------------------------------------------------------------------

<FilesMatch "^\.">

# Apache < 2.3
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
  Satisfy All
</IfModule>

# Apache ≥ 2.3
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>

</FilesMatch>

# ----------------------------------------------------------------------
# | Block access to files that can expose sensitive information        |
# ----------------------------------------------------------------------

<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$">

  # Apache < 2.3
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
    Satisfy All
  </IfModule>

  # Apache ≥ 2.3
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>

</FilesMatch>

# ----------------------------------------------------------------------
# | Reducing MIME type security risks                                  |
# ----------------------------------------------------------------------

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
</IfModule>

# ----------------------------------------------------------------------
# | Server-side technology information                                 |
# ----------------------------------------------------------------------

<IfModule mod_headers.c>
  Header unset X-Powered-By
</IfModule>

# ----------------------------------------------------------------------
# | Server software information                                        |
# ----------------------------------------------------------------------

ServerSignature Off

# ----------------------------------------------------------------------
# | Block PHP in public directory                                     |
# ----------------------------------------------------------------------

<IfModule mod_rewrite.c>
  RewriteRule ^public/.*\.(?:php[1-6]?|pht|phtml?)$ - [NC,F]
</IfModule>

# ----------------------------------------------------------------------
# | Filter HTTP Request methods                                        |
# ----------------------------------------------------------------------

<IfModule mod_rewrite.c>
  RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD) [NC]
  RewriteRule ^(.*)$ - [F]
</IfModule>

# ----------------------------------------------------------------------
# | Only allow my site to frame itself                                 |
# ----------------------------------------------------------------------

<IfModule mod_headers.c>
  Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
