.htaccess

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent directory browsing
    Options -Indexes

    # Block direct web access to sensitive environment, config, and script files
    <FilesMatch "^\.env|composer\.(json|lock)|package\.(json|lock)|phpunit\.xml|artisan|deploy\.sh|\.gitignore">
        Order allow,deny
        Deny from all
    </FilesMatch>

    # Block access to .git repository if present
    RewriteRule ^\.git - [F,L,NC]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect all incoming requests to the public directory
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>