Options -Indexes
DirectoryIndex index.php
RewriteEngine On

# Bloquea carpetas privadas
RewriteRule ^(app|config|database|storage)(/|$) - [F,L]

# Bloquea archivos sensibles
<FilesMatch "^(config\.php|config\.example\.php|schema\.sql|.*\.(log|ini|env|bak|old))$">
    Require all denied
</FilesMatch>

# Enrutamiento opcional para URLs limpias
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
