Options -Indexes
<IfModule mod_headers.c>
 Header always set X-Content-Type-Options "nosniff"
 Header always set X-Frame-Options "DENY"
 Header always set Referrer-Policy "strict-origin-when-cross-origin"
 Header always set Content-Security-Policy "frame-ancestors 'none'; object-src 'none'; base-uri 'self'"
 # Enable HSTS only after verifying HTTPS on every relevant hostname.
</IfModule>
<FilesMatch "^(?:\.env|composer\.(?:json|lock)|.*\.(?:sql|log|bak|ini))$">
 Require all denied
</FilesMatch>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)$ index.php?route=$1 [QSA,L]


<Files "legal.php">
 <IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
 </IfModule>
</Files>
