Options -Indexes

<FilesMatch "\.(sql|log|ini|env|key|pem|bak|backup|md)$">
    Require all denied
</FilesMatch>

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"