# Model Ortho Client Portal — Access Control
# Deny direct access to sensitive files, route all requests through PHP.

# Deny access to config and schema
<FilesMatch "^(config\.php|schema\.sql|functions\.php)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect uploads directory from direct web access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^uploads/ - [F,L]
</IfModule>

# Prevent directory listing
Options -Indexes

# PHP session security
php_flag session.cookie_httponly On
php_flag session.cookie_secure On
php_flag session.use_only_cookies On
