# Disable directory browsing
Options -Indexes

# Allow access to safe file types
<FilesMatch "\.(jpg|jpeg|png|webp|ico|gif|css|css\.twig|js|pdf|docx|xlsx|txt|ttf|otf|woff|woff2|eot)$">
    Require all granted
</FilesMatch>

# Block access to sensitive file types
<FilesMatch "\.(php|html?)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    <FilesMatch "\.(ttf|otf|eot|woff|woff2)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>