Options -Indexes

# Block direct web access to internal folders (PHP includes still work)
<IfModule mod_alias.c>
  RedirectMatch 404 ^/(data|pages|partials)/
</IfModule>

# Basic hardening
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
