# Deny direct web access to everything except the front controller and public assets.
<FilesMatch "\.(php)$">
    <If "%{REQUEST_URI} !~ m#^/free_qr_code_generator/(index\.php|api\.php)?$#">
        Require all denied
    </If>
</FilesMatch>

# Belt-and-suspenders: block entire sensitive directories outright.
RewriteEngine On
RewriteRule ^(src|data|vendor|composer\.(json|lock))(/|$) - [F,L]

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "same-origin"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self'; base-uri 'none'; form-action 'self'"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

Options -Indexes
