Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^sitemap\.xml$ sitemap-xml.php [L]
RewriteRule ^(?:app|config|database|tools)(?:/|$) - [F,L]
RewriteRule ^storage/(?!uploads/) - [F,L]
RewriteRule "(^|/)\." - [F,L]
RewriteCond %{REQUEST_URI} !/(admin|customer|actions)/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* 404.php [L]
</IfModule>
ErrorDocument 404 /404.php

<FilesMatch "(?i)(^\.env|^composer\.(json|lock)$|^phpunit\.xml|\.(bak|conf|dist|env|ini|log|md|sh|sql|sqlite|yml|yaml))$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
