# ---------------------------------------------------------------------------
# This folder is the only one that should be reachable over the web.
# ---------------------------------------------------------------------------

DirectoryIndex index.php
Options -Indexes

# The app is not for search engines.
<IfModule mod_headers.c>
  Header set X-Robots-Tag "noindex, nofollow"
  Header set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
</IfModule>

# Force HTTPS. Comment this block out if you are testing over plain http.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>
