.htaccess

<IfModule mod_rewrite.c>

RewriteEngine On

##
# If you are getting 404 errors on subpages, you may have to uncomment the RewriteBase entry
# You should change the '/' to your appropriate subfolder. For example if you have
# your Grav install at the root of your site '/' should work, else it might be something
# along the lines of: RewriteBase /<your_sub_folder>
##

# RewriteBase /

# access site
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php [L]

# block various user files from being accessed directly
RewriteRule ^user/accounts/(.*)$ error [L]
RewriteRule ^user/config/(.*)$ error [L]
RewriteRule ^user/(.*)\.(txt|md|html|php|yaml|json|twig|sh|bat)$ error [L]

# block cache
RewriteRule ^cache/(.*) error [L]

# block bin
RewriteRule ^bin/(.*)$ error [L]

# block system
RewriteRule ^system/(.*)\.(txt|md|html|php|sh|bat|yaml)$ error [L]

# block vendor (non CSS/JS)
RewriteRule ^vendor/(.*)\.(txt|md|html|php|sh|bat|yaml)$ error [L]

</IfModule>

# Prevent file browsing
Options -Indexes