DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
Options +FollowSymlinks -Multiviews
RewriteEngine On

# Prevent hosting-panel error pages from being rewritten to the site homepage.
ErrorDocument 403 "Access denied"
ErrorDocument 404 "Not found"

# The installer front controller is reachable only while install.lock is absent;
# every other file in install (SQL, lock, token and templates) stays private.
RewriteRule ^install/?$ install/index.php [L,NC]
RewriteRule ^install/index\.php$ - [L,NC]
RewriteRule ^install(?:/|$) - [F,L,NC]

# Block application source, runtime data and hidden files from HTTP access.
RewriteRule ^(?:app|config|runtime|vendor|tests)(?:/|$) - [F,L,NC]
RewriteRule ^composer\.(?:json|lock)$ - [F,L,NC]
RewriteRule ^(?:uploads?|public/static|template|runtime)/.*\.(?:php[0-9]?|phtml|phar|inc)$ - [F,L,NC]
RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,L,NC]
</IfModule>

<FilesMatch "\.(?:env|ini|log|sql|sqlite|bak|old|dist|lock|token|part|ya?ml|zip|tar|gz|tgz|7z|rar)$">
    Require all denied
</FilesMatch>
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php?/$1 [QSA,PT,L]
</IfModule>
