# MustrHQ — baseline hardening for Apache / cPanel.

# Never list the contents of a folder.
Options -Indexes

# Serve index.php when a folder is requested.
DirectoryIndex index.php index.html

# Block direct access to files that should never be fetched over the web:
# the database schema, backups and release archives, docs, and dotfiles.
<FilesMatch "(^\.|\.(sql|zip|tar|gz|md|log|bak|old|ini|sh)$)">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# config.php is PHP (so it is executed, not shown), but deny it outright too.
<Files "config.php">
    Require all denied
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>

# Don't leak the PHP version in response headers.
<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
</IfModule>
