first commit

backend/.htaccess

@@ -0,0 +1,27 @@
+# Protect includes directory
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+
+    # Block direct access to includes/
+    RewriteRule ^includes/ - [F,L]
+
+    # Block access to config files
+    RewriteRule ^config\.php$ - [F,L]
+
+    # Block access to hidden files
+    RewriteRule (^|/)\. - [F,L]
+
+    # Block access to SQL files
+    RewriteRule \.sql$ - [F,L]
+
+    # Block access to log files
+    RewriteRule \.log$ - [F,L]
+</IfModule>
+
+# Disable directory listing
+Options -Indexes
+
+# Prevent script execution in includes
+<Directory "includes">
+    php_flag engine off
+</Directory>