Options -Indexes
DirectoryIndex index.php
<FilesMatch "^(bootstrap\.php|.*\.(?:sql|log|env|bak|ini)|composer\.(?:json|lock)|package(?:-lock)?\.json)$">
  Require all denied
</FilesMatch>
RewriteEngine On
RewriteRule ^api(?:/.*)?$ api/index.php [QSA,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
