Options -Indexes

# Deny direct HTTP access to PHP files in the app directory.
# This does NOT affect PHP require/include — only HTTP requests.
# On LiteSpeed, use <If> instead of <FilesMatch> for better compatibility.
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block direct HTTP requests to any .php file in app/
    RewriteCond %{THE_REQUEST} ^.*/app/.*\.php [NC]
    RewriteRule ^ - [F,L]
</IfModule>

# Fallback: Also use FilesMatch for Apache
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>
