.htaccess

# Installer .htaccess - Protezione Directory

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /installer/

    # Block access if .installed file exists (allow ?force parameter for reinstall)
    RewriteCond %{DOCUMENT_ROOT}/.installed -f
    RewriteCond %{REQUEST_URI} !force [NC]
    RewriteCond %{QUERY_STRING} !force [NC]
    RewriteRule ^(.*)$ / [L,R=302]

    # Allow access to assets (CSS, JS, images)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

# Prevent directory browsing
Options -Indexes

# Protect sensitive files
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to database files specifically
<FilesMatch "^(schema|data|backup.*)\.(sql|sql\.gz)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Block direct access to PHP classes (except index.php)
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        <If "%{REQUEST_URI} !~ m#/index\.php$#">
            Require all denied
        </If>
    </IfModule>
    <IfModule !mod_authz_core.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !index\.php$
        RewriteRule .* - [F,L]
    </IfModule>
</FilesMatch>

# Set proper MIME types
AddType text/css .css
AddType application/javascript .js