# Downloads Widget — Apache beveiliging

# Gevoelige bestanden blokkeren voor directe toegang
<FilesMatch "^(data\.json|config\.php|functies\.php|beveiliging\.php|log\.php|watermerk\.php|vragen\.json|log\.json)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Directory listing uitschakelen (niemand kan mapinhoud zien)
Options -Indexes

# PHP-bestanden in uploads en import mappen verbieden
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Maar de widget-PHP bestanden zelf wél toestaan
<FilesMatch "^(index|admin|download|bestand|sitemap|rss)\.php$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

# Beveiligingsheaders
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "ALLOWALL"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Cache-controle voor statische assets
<FilesMatch "\.(css|js|png|jpg|jpeg|gif|svg|ico|woff|woff2)$">
    Header set Cache-Control "max-age=2592000, public"
</FilesMatch>
