RewriteEngine On

# Prevent direct HTTP access to server-side support files.
RewriteRule ^(?:config|includes|database)(?:/|$) - [F,NC,L]
RewriteRule (^|/)(?:\.env(?:\..*)?|\.ht(?:access|passwd)|(?:config|configuration|secrets?|credentials?)(?:\.[^/]*)?|[^/]+\.(?:ini|log|sql|sqlite3?|db|bak|backup|old|orig|swp|pem|key|p12|pfx))$ - [F,NC,L]

Options -Indexes

RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1|\[::1\])(:[0-9]+)?$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000" "expr=%{HTTPS} == 'on'"
</IfModule>
