# Send every request to index.php (so /students works as well as /index.php?r=students)
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.php [QSA,L]
</IfModule>

# Don't list folder contents
Options -Indexes

# Basic hardening
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "same-origin"
</IfModule>

# Never serve raw PHP source or the config
<FilesMatch "\.(sql|md|log)$">
  Require all denied
</FilesMatch>
