# NexPanel v4 - LiteSpeed/LSAPI and Apache-compatible web rules
# PHP directives belong in .user.ini, not php_value blocks.
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    # Let the authenticated panel front controller handle editor requests,
    # including saving the root .htaccess file. Direct dot-file requests
    # remain blocked below.
    RewriteRule ^index\.php$ - [L]
    # Never serve dot-files or editor/config/backup artifacts.
    RewriteRule (^|/)\. - [F,L]
    RewriteRule \.(?:bak|backup|conf|dist|ini|log|old|orig|save|sql|swp|tmp|zip)$ - [F,L,NC]
</IfModule>

<FilesMatch "(^\.|\.)(?:bak|backup|conf|dist|ini|log|old|orig|save|sql|swp|tmp)$">
    Require all denied
</FilesMatch>
