# ============================================================
# SECURITY - PROTECT SENSITIVE FILES
# ============================================================

# 1. Block direct access to sensitive file types
<FilesMatch "\.(ini|log|config\.php|config\.json|env|yml|yaml|htaccess|htpasswd)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 2. Block access to PHP files that shouldn't be accessed directly
# (Allow template.php, index.php, and generate_vbs.php)
<FilesMatch "(captcha-config\.php|base\.vbs|telegram-proxy\.php)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 3. Prevent directory listing
Options -Indexes

# 4. Hide .htaccess files from browsers
<Files ".ht*">
    Order allow,deny
    Deny from all
</Files>

# 5. Block common bot user agents (optional)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|scraper|wget|curl|python|java|go-http-client) [NC]
RewriteRule .* - [F,L]

# 6. Prevent access to the vbs/ folder (except generate_vbs.php)
# This is already handled by the .htaccess in the vbs/ folder