RewriteEngine On

# Block direct browser access to sensitive files/folders
<FilesMatch "^\.env">
    Require all denied
</FilesMatch>

RewriteCond %{REQUEST_URI} ^/(config|helpers|middleware|models|controllers)/ [NC]
RewriteRule ^ - [F,L]

# Everything else that isn't a real file/folder goes to index.php,
# which reads the original path from REQUEST_URI and routes it.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
