# SoulGuard Seal recommended Apache/LiteSpeed protective baseline.
# Test first in staging. PHP must be configured as executable, NEVER served as text.
Options -Indexes
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
<FilesMatch "(?i)(^\.|\.env$|\.sql$|\.sqlite$|\.db$|\.log$|\.zip$|\.bak$|\.old$|\.ini$|\.conf$|^error_log$|^attack\.php$|^admin_setup\.php$|^test\.php$|^config(?:org|_sqlite)?\.php$)">
 Require all denied
</FilesMatch>

# Preserve the PHP handler that was present in the uploaded cPanel configuration.
# Verify this handler with your hosting provider before enabling on production.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82___lsphp .php .php8 .phtml
</IfModule>
