DirectoryIndex index.php
Options -Indexes

# Fuerza HTTPS
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Bloquea el acceso directo a datos y código interno
RewriteRule ^(data|inc)(/|$) - [F,L]
<FilesMatch "\.(sqlite|sqlite3|db|md)$">
  Require all denied
</FilesMatch>

<IfModule mod_headers.c>
  Header always set X-Frame-Options "DENY"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
  Header always set X-Robots-Tag "noindex, nofollow"
</IfModule>