Options -Indexes
<FilesMatch "\.(php\d*|phtml|phar|cgi|pl|py|sh|htaccess)$">
  Require all denied
</FilesMatch>
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  <FilesMatch "\.(?:avif|gif|ico|jpe?g|png|webp|svg)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
</IfModule>
