Options -Indexes
DirectoryIndex index.php

<IfModule mod_authz_core.c>
    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>
    <FilesMatch "\.(json|log|md|sh|gitkeep)$">
        Require all denied
    </FilesMatch>
    <FilesMatch "\.(?:env|ini|conf|pem|key|crt|p12|sql|sqlite|bak)$">
        Require all denied
    </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # includes/ is application code, not a public URL. This works whether
    # public/ is mounted at the domain root or below a URL prefix.
    RewriteRule ^includes(?:/|$) - [F,L]

    # Resolve the site's extensionless convenience routes without RewriteBase:
    # Apache supplies the correct per-directory prefix in either deployment.
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^([^./]+?)/?$ $1.php [L]
</IfModule>