Options -Indexes

<FilesMatch "^(config\.php|db\.php|utils\.php|telegram\.php|auth_admin\.php)$">
  Require all denied
</FilesMatch>

# Block cron endpoints from web access (run via server cron only)
<FilesMatch "^cron_.*\.php$">
  Require all denied
</FilesMatch>

# Block logs and common sensitive files
<FilesMatch "^(error_log|\.env|composer\.(json|lock)|package\.(json|lock))$">
  Require all denied
</FilesMatch>

<FilesMatch "\.(zip|rar|7z|tar|gz|sql|bak|old|log)$">
  Require all denied
</FilesMatch>
