.htaccess

# Set the default handler.
DirectoryIndex index.php index.html index.htm

# Prevent directory listing
Options -Indexes

# Make sure MultiViews is disabled if available.
<IfModule mod_negotiation.c>
  Options -MultiViews
</IfModule>

<FilesMatch "\.(dist|db|markdown|md|twig|yaml|yml)|(bower|composer|jsdoc|package)\.json$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
  </IfModule>
</FilesMatch>

<IfModule mod_rewrite.c>
  RewriteEngine on

  RewriteRule cache/ - [F]

  # Some servers require the RewriteBase to be set. If so, set to the correct folder.
  # RewriteBase /

  RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
  RewriteRule ^(.*) - [E=BASE:%1]

  # Sets the HTTP_AUTHORIZATION header removed by Apache
  RewriteCond %{HTTP:Authorization} .
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

  # Redirect to URI without front controller to prevent duplicate content
  # (with and without `/index.php`). Only do this redirect on the initial
  # rewrite by Apache and not on subsequent cycles. Otherwise we would get an
  # endless redirect loop (request -> rewrite to front controller ->
  # redirect -> request -> ...).
  # So in case you get a "too many redirects" error or you always get redirected
  # to the start page because your Apache does not expose the REDIRECT_STATUS
  # environment variable, you have 2 choices:
  # - disable this feature by commenting the following 2 lines or
  # - use Apache >= 2.3.9 and replace all L flags by END flags and remove the
  #   following RewriteCond (best solution)
  RewriteCond %{ENV:REDIRECT_STATUS} ^$
  RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]

  # If the requested filename exists, simply serve it.
  # We only want to let Apache serve files and not directories.
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteCond %{REQUEST_FILENAME} -f
  RewriteRule ^ - [L]

  # Rewrite all other queries to the front controller.
  RewriteRule ^ %{ENV:BASE}/index.php [L]

</IfModule>


# set the correct mime type for woff2 font type
# =============================================
# if you don't set your own mimetypes or you aren't using
# HTML5 Boilerplate Server Configs https://github.com/h5bp/server-configs-apache
# then you can uncomment (delete the hash/pound/octothorpe/number symbol)
# the section below:

#<IfModule mod_mime.c>
#  AddType application/font-woff2    woff2
#</IfModule>

# Block access to all hidden files and directories. These types of files
# usually contain user preferences and can include private information like,
# for example, the `.git` or `.svn` directories.
<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
   RewriteCond %{SCRIPT_FILENAME} -d [OR]
   RewriteCond %{SCRIPT_FILENAME} -f
   RewriteRule "(^|/)\." - [F]
</IfModule>