<IfModule mod_autoindex.c>
  Options -Indexes
</IfModule>
DirectoryIndex index.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Preserve Authorization headers for JWT under CGI/FastCGI.
  RewriteCond %{HTTP:Authorization} ^(.+)
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1]

  # Block private application directories.
#   RewriteRule ^(?:app|includes|storage|template)(?:/|$) - [F,L,NC]

  # Never route the API front controller back through the API rewrite.
  RewriteRule ^api/index\.php$ - [L,NC]

  # API routes:
  # /api
  # /api/auth/login
  RewriteRule ^api/?$ api/index.php [L,QSA,NC]
  RewriteRule ^api/(.+?)/?$ api/index.php?route=$1 [L,QSA,NC]

  # Extensionless PHP URLs:
  # /contact -> /contact.php
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}.php -f
  RewriteRule ^([A-Za-z0-9/_-]+?)/?$ $1.php [L,NC]

  # Missing URLs below /members use the site's 404 page.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^members(?:/.*)?$ 404.php [L,NC]

  # All other application URLs fall back to the homepage.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_setenvif.c>
  SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1
</IfModule>

# Protect secrets, configuration, documentation, and repository files.
<FilesMatch "^(?:\.env(?:\..*)?|\.gitignore|\.user\.ini|config\.php|README\.md|DEPLOYMENT-PHP74\.md)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order Allow,Deny
    Deny from all
  </IfModule>
</FilesMatch>

# Do not allow downloadable archives or JSON files.
<FilesMatch "\.(?:zip|json|sqlite|sqlite3|log|ini)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order Allow,Deny
    Deny from all
  </IfModule>
</FilesMatch>

# Allow the custom forbidden page when one exists.
<Files "403.shtml">
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order Allow,Deny
    Allow from all
  </IfModule>
</Files>

# BEGIN cPanel-generated php ini directives, do not edit
# Use cPanel MultiPHP INI Editor to configure:
# display_errors = Off
# max_execution_time = 90
# memory_limit = 256M
# post_max_size = 16M
# upload_max_filesize = 12M
# END cPanel-generated php ini directives, do not edit

# php -- BEGIN cPanel-generated handler, do not edit
# PHP 7.4 handler for cPanel EasyApache 4.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>

# php -- END cPanel-generated handler, do not edit

<IfModule mod_headers.c>
    Header always unset panel
    Header always unset platform
    Header always unset X-Powered-By
</IfModule>

# PHP expose off
<IfModule lsapi_module>
    php_flag expose_php Off
</IfModule>