.htaccess

# Protect files and directories
<FilesMatch "\.(po|mo|twig|cache|dat)$|^(\.(?!well-known).composer\.(json|lock))$|^#.*#$|\.php(~)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
  </IfModule>
</FilesMatch>

Options -Indexes
DirectoryIndex index.php

AddDefaultCharset UTF-8

#<IfModule mod_expires.c>
#    ExpiresActive on
#    ExpiresDefault                                      "access plus 1 month"
#
#  # CSS
#    ExpiresByType text/css                              "access plus 1 year"
#
#  # Data interchange
#    ExpiresByType application/json                      "access plus 0 seconds"
#    ExpiresByType application/ld+json                   "access plus 0 seconds"
#    ExpiresByType application/xml                       "access plus 0 seconds"
#    ExpiresByType text/xml                              "access plus 0 seconds"
#
#  # Favicon (cannot be renamed!) and cursor images
#    ExpiresByType image/x-icon                          "access plus 1 week"
#
#  # HTML components (HTCs)
#    ExpiresByType text/x-component                      "access plus 1 month"
#
#  # HTML
#    ExpiresByType text/html                             "access plus 0 seconds"
#
#  # JavaScript
#    ExpiresByType application/javascript                "access plus 1 year"
#
#  # Manifest files
#    ExpiresByType application/x-web-app-manifest+json   "access plus 0 seconds"
#    ExpiresByType text/cache-manifest                   "access plus 0 seconds"
#
#  # Media
#    ExpiresByType audio/ogg                             "access plus 1 month"
#    ExpiresByType image/gif                             "access plus 1 month"
#    ExpiresByType image/jpeg                            "access plus 1 month"
#    ExpiresByType image/png                             "access plus 1 month"
#    ExpiresByType video/mp4                             "access plus 1 month"
#    ExpiresByType video/ogg                             "access plus 1 month"
#    ExpiresByType video/webm                            "access plus 1 month"
#
#  # Web feeds
#    ExpiresByType application/atom+xml                  "access plus 1 hour"
#    ExpiresByType application/rss+xml                   "access plus 1 hour"
#</IfModule>

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]