Options -Indexes
DirectoryIndex index.html
<IfModule mod_headers.c>
 Header always set X-Content-Type-Options "nosniff"
 Header always set Referrer-Policy "same-origin"
 Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>
<FilesMatch "(?i)^((?:config.*|validation)\.php|.*\.(sql|json|zip|log|bak|env))$">
 Require all denied
</FilesMatch>
# Do not enable directory-wide Basic Auth: the public donation page must remain public.
# Private API actions enforce per-user login and roles in PHP.
