Options -Indexes
DirectoryIndex index.php

# Keep setup available only for the one-time owner creation script.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(?:config|database)/ - [F,L,NC]
RewriteRule ^install/(?!create_owner\.php$) - [F,L,NC]
RewriteRule ^(?:README\.md|\.git|\.env)(?:/|$) - [F,L,NC]
</IfModule>

<FilesMatch "^(?:\.htaccess|\.htpasswd|\.env|README\.md|composer\.(?:json|lock)|package\.json)$">
  Require all denied
</FilesMatch>
