Options -Indexes

<IfModule mod_rewrite.c>
RewriteEngine On

# Never serve frozen data directly.
RewriteRule ^data(?:/|$) - [F,L]

# Friendly secret client portal URLs.
RewriteRule ^client/([a-f0-9]{48})/?$ portal.php?client=$1 [L,QSA]
RewriteRule ^client/([a-f0-9]{48})/report\.php$ report.php?client=$1 [L,QSA]
RewriteRule ^client/([a-f0-9]{48})/source_text_viewer\.php$ source_text_viewer.php?client=$1 [L,QSA]
RewriteRule ^client/([a-f0-9]{48})/explainer\.php$ explainer.php?client=$1 [L,QSA]
</IfModule>

<FilesMatch "^(config\.php|app_lib\.php|builder_lib\.php|client_bootstrap\.php|static_lib\.php)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "same-origin"
Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>
