Options -Indexes
ServerSignature Off

# Protect sensitive files
<FilesMatch "\.(sql|log|md|sh)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Protect config directory
<FilesMatch "^(database\.php)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Protect logs directory
<FilesMatch "\.log$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Custom error pages
ErrorDocument 403 /medrecord/403.php
ErrorDocument 404 /medrecord/404.php

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Gzip compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript
</IfModule>

# Cache static assets
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
</IfModule>
