# Football API v3 — Apache config

# Block direct access to helpers
<FilesMatch "^(bootstrap|config|utils|logos|streams)\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "no-referrer"
</IfModule>

AddDefaultCharset UTF-8
