# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Block access to config.php
<Files "config.php">
    Deny from all
</Files>

# Block access to sensitive files
<FilesMatch "\.(env|log|ini|sql)$">
    Deny from all
</FilesMatch>

# Limit upload size
php_value upload_max_filesize 10M
php_value post_max_size 10M