Header always set X-Frame-Options: "deny"
Header always set Content-Security-Policy: "script-src 'self' ajax.googleapis.com cdnjs.cloudflare.com; reflected-xss block;"
<Files ~ ".json$">
Order Allow,Deny
Deny from all
</Files>
<Files ~ ".lock$">
Order Allow,Deny
Deny from all
</Files>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [L]