DirectoryIndex index.php
Options -Indexes

# 安全响应头（对静态资源与 PHP 输出双重生效）
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

<IfModule mod_authz_core.c>
    <FilesMatch "\.(sql|tar\.gz|tgz|log|history\.json)$">
        Require all denied
    </FilesMatch>
</IfModule>
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(sql|tar\.gz|tgz|log|history\.json)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
