# cedimik closeout: never serve backup/source artifacts over HTTP
<FilesMatch "\.(bak|corrupted|orig|rej|swp|save)(\.|$)">
    Require all denied
</FilesMatch>

# Session cookie hardening via mod_php (server runs mod_php: .user.ini is not read;
# these php_value directives apply on vhosts with AllowOverride enabled)
php_value session.cookie_httponly 1
php_value session.cookie_samesite Lax