DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block protected application directories.
    RewriteRule ^(?:app|config|database|docs|storage|tests|tools)(?:/|$) - [F,L,NC]

    # Hide the front-controller filename from public URLs.
    RewriteCond %{THE_REQUEST} \s/+(.*/)?index\.php[\s?] [NC]
    RewriteRule ^index\.php$ ./ [R=301,L]

    # No public PHP endpoints other than the one-time installer.
    RewriteCond %{THE_REQUEST} \s/+(.*/)?[^/?\s]+\.php[\s?] [NC]
    RewriteCond %{REQUEST_URI} !/install\.php$ [NC]
    RewriteRule ^ - [R=404,L]

    # Let real public assets pass through.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Route every clean URL through the application.
    RewriteRule ^ index.php [QSA,L]
</IfModule>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

<FilesMatch "(^\.|\.(?:sql|log|ini|dist|bak|backup|md)$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        <IfModule mod_access_compat.c>
            Order allow,deny
            Deny from all
        </IfModule>
    </IfModule>
</FilesMatch>
