What the shipped .htaccess protects

Since 1.11.0 WBAMS ships protective rules in the root .htaccess, outside the managed-rules markers so they survive when WBAMS rewrites its own rules.

Folder listing

Off for the whole site.

Package files

The manifest, composer files, every Markdown file and add-on manifests are refused.

Leftovers

Database dumps, logs, backups and editor leftovers are refused wherever they land.

Dot-files

Any file whose name starts with a dot (certificate checks under .well-known keep working).

Code and data folders

storage/, resources/, build/, tools/ and tests/, and PHP under core/ and framework/ that is never meant to be requested.

Security headers

nosniff, SAMEORIGIN framing, a strict referrer policy, and HSTS for a year on HTTPS.