# /api — PHP endpoints. Everything under lib/, cron/, config/ and data/ is private.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(lib|cron|config|data)(/|$) - [F,L]
</IfModule>

# Belt and braces for servers without mod_rewrite
<FilesMatch "^(bootstrap|Config|Log|Db|Http|Campuses|Phone|Validator|RateLimit|Turnstile|GeoIp|Geocode|Mailchimp|Sinch|LeadProcessor)\.php$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(json|sqlite|sqlite-wal|sqlite-shm|log|lock|env)$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
</IfModule>

Options -Indexes