# 禁止目录浏览
Options -Indexes

# 禁止访问敏感目录
<DirectoryMatch "^(.*/)?\.(?!well-known/)">
    Order deny,allow
    Deny from all
</DirectoryMatch>

# 保护 data 目录
<Directory "data">
    Order deny,allow
    Deny from all
</Directory>

# 保护 uploads 目录中的 PHP 文件
<Directory "uploads">
    <FilesMatch "\.php$">
        Order deny,allow
        Deny from all
    </FilesMatch>
</Directory>

# 保护 lib 目录
<Directory "lib">
    <FilesMatch "\.php$">
        Order deny,allow
        Deny from all
    </FilesMatch>
</Directory>

# 安全响应头
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob:; font-src 'self' https://cdnjs.cloudflare.com;"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

# 禁止访问配置文件
<FilesMatch "^(config\.php|shujuku\.php|auth_license_server\.php)$">
    Order deny,allow
    Deny from all
</FilesMatch>
