Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^data/ - [F,L]
    RewriteRule ^config\.php$ - [F,L]
    RewriteRule ^\.htaccess$ - [F,L]
    RewriteRule ^.*\.(db|sqlite|sqlite3|log|bak|old|env|ini|conf)$ - [F,L]
    RewriteRule ^admins/_archive/ - [F,L]
</IfModule>

<FilesMatch "\.(db|sqlite|sqlite3|log|bak|old|env|ini|conf)$">
    Require all denied
</FilesMatch>

<FilesMatch "^(config\.php|\.htaccess|\.htpasswd)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "no-referrer"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always unset X-Powered-By
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json
</IfModule>

<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value upload_max_filesize 16M
    php_value post_max_size 20M
    php_value max_execution_time 60
</IfModule>