# Sends every request through the public/ folder while keeping
# app/, config/, storage/ and vendor/ outside the document root.
# Works on shared hosting where you can only upload to public_html.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to internal directories and files
    RewriteRule ^(app|config|storage|vendor|composer\.(json|lock)|scripts)(/|$) - [F,L]

    # If request is not already inside /public, rewrite it there
    RewriteCond %{REQUEST_URI} !^.*/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Hide PHP version and protect sensitive files
<IfModule mod_headers.c>
    Header unset X-Powered-By
</IfModule>
<FilesMatch "\.(env|lock|log|md|sqlite|db|json)$">
    Require all denied
</FilesMatch>
