# Disable directory listing
Options -Indexes

# Prevent access to sensitive files
<FilesMatch "(^\.|wp-config\.php|php\.ini|php\.info|readme\.html)">
  Order deny,allow
  Deny from all
</FilesMatch>



# Protect against cross-site scripting (XSS) attacks
<IfModule mod_headers.c>
  Header set X-XSS-Protection "1; mode=block"
</IfModule>



# Enable Content Security Policy (CSP) to prevent XSS attacks
<IfModule mod_headers.c>
  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';"
</IfModule>
# Remove .php extension
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}.php -f
  RewriteRule ^([^/]+)/?$ $1.php [L]