# Protect sensitive files
<FilesMatch "(config\.php|schema\.sql|config\.sample\.php)$">
    Require all denied
</FilesMatch>

# Deny direct access to includes
RedirectMatch 403 (?i)/includes/

# Deny direct access to uploads (receipts served via receipt.php)
RedirectMatch 403 (?i)/uploads/

# Block common junk
<FilesMatch "(^\.|\.bak$|\.sql$|\.log$)">
    Require all denied
</FilesMatch>

Options -Indexes

# Optional: force HTTPS (uncomment if you have SSL)
# RewriteEngine On
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]