Options -Indexes
RewriteEngine On

# Block direct access to sensitive directories
RewriteRule ^(config|core|app|database|routes)/ - [F,L]

# Route everything through index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?url=$1 [QSA,L]
