# =========================================
# GLOBAL LOG DIRECTORY PROTECTION
# =========================================

# Disable directory listing
Options -Indexes

# Block all web access to logs
<IfModule mod_authz_core.c>
    <RequireAll>
        Require all denied
    </RequireAll>
</IfModule>

<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>

# Prevent direct access to common log formats
<FilesMatch "\.(log|txt|json|ndjson|csv|gz|zip|tar)$">
    Require all denied
</FilesMatch>

# Block backup / temp files
<FilesMatch "\.(bak|old|tmp|swp)$">
    Require all denied
</FilesMatch>

# No caching of sensitive data
<IfModule mod_headers.c>
    Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
    Header set Pragma "no-cache"
</IfModule>

# =========================================
# END LOG PROTECTION
# =========================================