Options -Indexes
DirectoryIndex index.php

# Block all private application and operational directories when installed in web root.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(?:app|database|docs|tests|storage)(?:/|$) - [F,L,NC]
  RewriteRule ^(?:\.env(?:\..*)?|composer\.(?:json|lock)|README\.md|DEPLOYMENT\.md)$ - [F,L,NC]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.php [QSA,L]
</IfModule>

<FilesMatch "^(\.env.*|composer\.(json|lock)|README\.md|DEPLOYMENT\.md|schema\.sql|app\.log)$">
  Require all denied
</FilesMatch>
