# Herramientas SS-Xavier — protección a nivel de servidor (Apache / LiteSpeed)
Options -Indexes
DirectoryIndex index.php

# Bloquear archivos que no deben verse nunca por web
<FilesMatch "(?i)^(?!robots\.txt$)(\..*|.*\.(txt|md|log|bak|old|orig|sql|ini|json|zip|csv)|.*~)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
    Header always set X-Robots-Tag "noindex, nofollow"
</IfModule>

# Forzar HTTPS (además del control en PHP)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
