# Block direct access to sensitive files
<FilesMatch "^(config\.php)$">
    Require all denied
</FilesMatch>

Options -Indexes

# CORS for the frontend (adjust origin if frontend is on a different domain)
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
