Options -Indexes
RewriteEngine On

# Protege arquivos sensíveis
<FilesMatch "(\.env|\.installed)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# Bloqueia pastas internas
RewriteRule ^(includes|cron)/ - [F,L]

# Headers de segurança
<IfModule mod_headers.c>
  Header always set X-Frame-Options "DENY"
  Header always set X-Content-Type-Options "nosniff"
  Header always unset X-Powered-By
</IfModule>
