# This folder is the document root: index.php here is the site's home page.
# Everything below protects the application internals that now live inside it.

DirectoryIndex index.php

# Primary protection: block the internal directories outright. This works even
# on hosts that ignore the per-directory .htaccess files in app/, config/, data/.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(app|config|data|docs)/ - [F,L]
</IfModule>

# Never serve dotfiles (.htaccess, .git*, …), flat-file data, docs, config
# templates or lock files as plain text — regardless of directory.
<FilesMatch "(^\.ht|^\.git|\.(?:json|md|lock)$|\.sample\.php$)">
    Require all denied
</FilesMatch>

# Belt-and-suspenders for older Apache that lacks the FilesMatch above.
<IfModule !mod_authz_core.c>
    <FilesMatch "(^\.ht|^\.git|\.(?:json|md|lock)$|\.sample\.php$)">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
