Options -Indexes -MultiViews

# Block direct HTTP access to every sensitive directory and file.
# Only the web/ subdirectory should be reachable by browsers.

RewriteEngine On

# .git — source code history fully reconstructable without this block
RewriteRule ^\.git(/|$) - [F,L]

# Runtime logs and cache — expose stack traces, file paths
RewriteRule ^runtime(/|$) - [F,L]

# Config — may expose DB credentials when PHP execution fails
RewriteRule ^config(/|$) - [F,L]

# Vendor — exposes exact package versions for CVE matching
RewriteRule ^vendor(/|$) - [F,L]

# Dependency manifests — expose full package inventory
RewriteRule ^composer\.(json|lock)$ - [F,L]

# Environment file
RewriteRule ^\.env$ - [F,L]

# CLI entry points — not meant for web access; expose internal paths
RewriteRule ^yii(\.bat)?$ - [F,L]

# Any other hidden file (dot-files)
RewriteRule (^|/)\. - [F,L]
