# Denegar acceso directo a archivos
<RequireAll>
    Require all denied
</RequireAll>

# Prevenir ejecución de scripts
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|sh|cgi)$">
    <RequireAll>
        Require all denied
    </RequireAll>
</FilesMatch>

# Solo permitir PDFs
<FilesMatch "\.pdf$">
    ForceType application/pdf
    Header set Content-Type "application/pdf"
</FilesMatch>

# Prevenir listado de directorio
Options -Indexes

# Headers de seguridad
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
</IfModule>