.htaccess

# Disable directory browsing
<IfModule mod_autoindex.c>
  Options -Indexes
</IfModule>

# Enable mod_rewrite
<IfModule mod_rewrite.c>
    Options +FollowSymlinks
    RewriteEngine On
</IfModule>

# Handle requests to admin (backend) without exposing /backend/web
<IfModule mod_rewrite.c>
    # Deal with admin requests
    RewriteCond %{REQUEST_URI} ^/(admin)
    RewriteRule ^admin/assets/(.*)$ backend/web/assets/$1 [L]
    RewriteRule ^admin/css/(.*)$ backend/web/css/$1 [L]
    RewriteRule ^admin/themes/(.*)$ backend/web/themes/$1 [L]
    RewriteRule ^admin/images/(.*)$ backend/web/images/$1 [L]
    RewriteRule ^admin/uploads/(.*)$ backend/web/uploads/$1 [L]
    RewriteRule ^admin/(.*)$ backend/web/$1 [L]

    # Redirect backend requests to backend index.php
    RewriteCond %{REQUEST_URI} !^/backend/web/(assets|css)/
    RewriteCond %{REQUEST_URI} ^/(admin)
    RewriteRule ^.*$ backend/web/index.php [L]

    # Handle requests to frontend without exposing /frontend/web
    RewriteCond %{REQUEST_URI} !^/(frontend|backend)/web/
    RewriteRule ^assets/(.*)$ frontend/web/assets/$1 [L]
    RewriteRule ^css/(.*)$ frontend/web/css/$1 [L]
    RewriteRule ^themes/(.*)$ frontend/web/themes/$1 [L]
    RewriteRule ^images/(.*)$ frontend/web/images/$1 [L]
    RewriteRule ^uploads/(.*)$ frontend/web/uploads/$1 [L]
    RewriteRule ^(.*)$ frontend/web/$1 [L]

    # Default route to frontend index.php for other requests
    RewriteCond %{REQUEST_URI} !^/(frontend|backend)/web/(assets|css)/
    RewriteCond %{REQUEST_URI} !index.php
    RewriteCond %{REQUEST_FILENAME} !-f [OR]
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^.*$ frontend/web/index.php [L]
</IfModule>

# Block access to backup and source files
<FilesMatch "(\.(bak|bat|config|sql|fla|md|psd|ini|log|sh|inc|swp|dist)|~|init|composer\.json|composer\.lock)$">
  Order allow,deny
  Deny from all
  Satisfy All
</FilesMatch>

# Increase cookie security
<IfModule php5_module>
  php_value session.cookie_httponly true
</IfModule>

# PHP version handling
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php72 .php .php7 .phtml
</IfModule>

# Additional PHP handler for cPanel compatibility
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81 .php .php8 .phtml
</IfModule>

# Allow access for localhost in Apache 2.4 or later
<IfModule mod_authz_core.c>
    Require all granted
</IfModule>

# Fallback for Apache versions before 2.4
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

# Enable pretty URLs by hiding index.php
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]