Options -Indexes
DirectoryIndex index.html login.php

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Strict-Transport-Security "max-age=31536000"
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>

<FilesMatch "\.(sql|log|ini|env|bak|swp|sh|old|zip)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>

<Files "install.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</Files>

<IfModule mod_php.c>
    php_flag display_errors off
    php_flag display_startup_errors off
    php_value log_errors on
    php_value session.cookie_httponly 1
    php_value session.use_strict_mode 1
    php_value session.cookie_samesite Strict
    php_flag session.cookie_secure on
</IfModule>
<IfModule mod_php8.c>
    php_flag display_errors off
    php_flag display_startup_errors off
    php_value log_errors on
    php_value session.cookie_httponly 1
    php_value session.use_strict_mode 1
    php_value session.cookie_samesite Strict
    php_flag session.cookie_secure on
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/png "access plus 7 days"
    ExpiresByType text/css "access plus 1 day"
    ExpiresByType application/javascript "access plus 1 day"
</IfModule>
