# Fallback for shared hosting where the document root cannot be pointed at
# public/. Prefer configuring the Document Root instead — see docs/DEPLOYMENT.md.
#
# This file only takes effect when the whole project sits inside a web-served
# folder. It rewrites every request into public/ and blocks direct access to
# application files.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Never serve the environment file, logs, or vendor sources.
    RewriteRule ^(\.env|\.env\..*|composer\.(json|lock)|package(-lock)?\.json|artisan|phpunit\.xml)$ - [F,L]
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor|docs)/ - [F,L]

    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<FilesMatch "^\.">
    Require all denied
</FilesMatch>

Options -Indexes
