# php -- handler de PHP (igual que Habits/Finance). Ajustá la versión si tu cPanel usa otra.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php83 .php .php8 .phtml
</IfModule>

Options -Indexes
DirectoryIndex app.php

# Nunca servir la config ni la key por HTTP.
<FilesMatch "^(config\.php|config\.local\.php|config\.local\.example\.php)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "no-referrer"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Permissions-Policy "camera=(), microphone=(self), geolocation=()"
</IfModule>
