# Fresh Start Movement NGO — root .htaccess

# Never let visitors browse a folder's file list.
Options -Indexes

# Show the site's own styled 404 page instead of the server's bare default.
ErrorDocument 404 /404.html

# Security headers (works on Apache/LiteSpeed, which is what virtually all
# cPanel hosting runs).
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Never allow direct access to includes/config.php even if something goes
# wrong with the includes/.htaccess file below (defense in depth).
<FilesMatch "^config\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
