# Prevent directory listings and direct access to configuration or CLI-only entry points.
Options -Indexes

<FilesMatch "^(config(?:\.local)?\.php|config\.local\.php\.example|publish_scheduled\.php)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "no-referrer"
</IfModule>