Options -Indexes
ServerSignature Off

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^data/ - [F,L]
    RewriteRule ^config\.php$ - [F,L]
    RewriteRule ^config-telegram\.php$ - [F,L]
    RewriteRule ^config-rich\.php$ - [F,L]
    RewriteRule ^config-ai\.php$ - [F,L]
    RewriteRule ^webhook-.*\.php$ - [F,L]
    RewriteRule ^sync\.php$ - [F,L]
    RewriteRule ^\.htaccess$ - [F,L]
    RewriteRule ^.*\.(db|sqlite|sqlite3|log|bak|old|env|ini|conf)$ - [F,L]
    RewriteRule ^admins/_archive/ - [F,L]
</IfModule>

<FilesMatch "\.(db|sqlite|sqlite3|log|bak|old|env|ini|conf)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<FilesMatch "^(config\.php|config-telegram\.php|config-rich\.php|config-ai\.php|webhook-.*\.php|sync\.php|\.htaccess|\.htpasswd)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json
</IfModule>

<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value upload_max_filesize 32M
    php_value post_max_size 32M
    php_value max_execution_time 120
    php_value session.cookie_httponly On
    php_value session.cookie_samesite Lax
</IfModule>