# 1. Force HTTPS for all incoming requests
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 2. Prevent directory listing / file browsing
Options -Indexes

# 3. Block direct browser access to core backend system files
<FilesMatch "^(db|config)\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# 4. Optional: Block direct browser access to all PHP scripts unless requested via AJAX/Fetch
# (Uncomment the block below if you want absolute lockdown on all .php files from direct browser typing)
/*
<FilesMatch "\.php$">
    # Allow if requested via your app/fetch, block if accessed directly via browser URL bar
    # Note: Modern PHP frameworks handle routing, but for simple script folders, 
    # relying on your Bearer Token check in db.php is usually sufficient.
</FilesMatch>
*/