# =========================================================================
# Fociz Pentest & Security Hardening (.htaccess)
# =========================================================================

# 1. Schakel directory listing uit
Options -Indexes

# 2. Blokkeer directe toegang tot verborgen systeembestanden (.env, .git, etc.)
<FilesMatch "^\.">
    <IfModule authz_core_module>
        Require all denied
    </IfModule>
    <IfModule !authz_core_module>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# 3. Blokkeer directe toegang tot gevoelige bestandsformaten
<FilesMatch "\.(sql|log|example|md|json|lock|bak|conf)$">
    <IfModule authz_core_module>
        Require all denied
    </IfModule>
    <IfModule !authz_core_module>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# 4. Beveiligingsheaders
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header unset X-Powered-By
</IfModule>