Options -Indexes -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Allow hosting-provider certificate verification files.
    RewriteRule ^\.well-known/(?:acme-challenge|pki-validation)/[a-zA-Z0-9_-]+(?:\.txt)?$ - [END]

    RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,END]
    RewriteRule ^(?:app|bootstrap|config|database|node_modules|resources|routes|tests|tools|vendor|public)(?:/|$) - [F,END,NC]
    RewriteRule ^storage/(?:app|framework|logs)(?:/|$) - [F,END,NC]
    RewriteRule ^(?!index\.php$).*\.(?:php[0-9]?|phtml|phar)(?:[./]|$) - [F,END,NC]

    # Public storage always goes through Laravel, with or without a symlink.
    RewriteRule ^storage(?:/|$) index.php [END]

    RewriteRule ^((?:build|css|js|images|fonts)/.+\.(?:css|js|mjs|json|map|png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf|eot))$ public/$1 [END,NC]
    RewriteRule ^(favicon\.ico|robots\.txt)$ public/$1 [END,NC]

    # Never bypass Laravel for existing files or directories in the project root.
    RewriteRule ^ index.php [END]
</IfModule>

<IfModule !mod_rewrite.c>
    Require all denied
</IfModule>
