.htaccess

<IfModule mod_rewrite.c>

  # Don't use SymLinksIfOwnerMatch on windows
  Options +SymLinksIfOwnerMatch
  #Options +FollowSymLinks
  RewriteEngine On

  # FIX: php-cgi under Apache does not pass HTTP Basic user/pass to PHP by default
  RewriteCond %{HTTP:Authorization} ^(.+)$
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

  # Allow .well-known directory for use by Let's Encrypt.
  RewriteRule ^\.well-known - [L]

  # Deny access to:
  # - the private folder,
  # - any path starting with a dot,
  # - .json,.lock and .log files on the root folder,
  # - .php files other than index.php on the root folder.
  # - anything from the bin folder.
  RewriteRule ^(private/|\.|\w+\.(json|lock|log)) - [F,L,NC]
  RewriteRule ^(?!index)[^./]+\.php - [F,L,NC]
  RewriteRule ^bin/ - [F,L,NC]

  # Serve existing files files.
  RewriteCond %{REQUEST_FILENAME} -f
  RewriteRule ^ - [L]

  # Deny all other existing files.
  RewriteCond %{REQUEST_FILENAME} -f
  RewriteRule ^ - [F,L,NC]

  # Split the REQUEST_URI into a BASE_URI and a PATH.
  RewriteRule ^(.*) - [E=PATH:/$1]
  RewriteCond %{REQUEST_URI}%{ENV:PATH} ^(.*?)(.+)\2$
  RewriteRule ^ - [E=BASE_URI:%1]

  # Restore the suppressed Authorization header on FastCGI servers.
  SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0

  # Call the front-controller.
  RewriteRule ^ %{ENV:BASE_URI}/index.php [L]

</IfModule>

# Disable multiviews to prevent interference with virtual routing.
<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

# Compress some file types.
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/json text/javascript application/javascript
</IfModule>