Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Redirect HTTP to HTTPS.
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # Deny direct access to config directory.
    RewriteRule ^config(?:/|$) - [F,L,NC]
</IfModule>

# Block hidden files and sensitive configuration/backup files.
<FilesMatch "(^\.|\.env$|\.ini$|\.log$|\.sql$|\.bak$|\.old$|\.swp$|composer\.(json|lock)$)">
    Require all denied
</FilesMatch>