# MERGE these lines into your existing public_html/.htaccess (do not overwrite it).
Options -Indexes

<IfModule mod_rewrite.c>
RewriteEngine On
# Force HTTPS (portal + admin handle patient/staff data, HTTPS is mandatory)
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_headers.c>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>

<FilesMatch "\.(sql|log|md|ini|env|bak|txt)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>