# Block direct access to config files and anything that isn't a .php entrypoint.
<FilesMatch "\.(example\.php|json|md)$">
  Require all denied
</FilesMatch>
<Files "config.php">
  Require all denied
</Files>

# Allow CORS only from same origin by default; loosen only if you split hosting.
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
</IfModule>
