# Public web root hardening
Options -Indexes

<IfModule mod_authz_core.c>
    <FilesMatch "(?i)\.(env|sql|md|log|ini|bak|old|yml|yaml|json|lock)$">
        Require all denied
    </FilesMatch>
</IfModule>

# Prevent script execution inside assets if misconfigured
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^assets/.*\.(php|phtml|phar)$ - [F,L]
</IfModule>
