.htaccess

<IfModule mod_rewrite.c>

  Options +SymLinksIfOwnerMatch
  RewriteEngine On

  # Deny access to:
  # - any path starting with a dot,
  # - .json,.lock and .log files on the root folder,
  # - .php files other than index.php on the root folder.
  # - anything from the bin folder.
  RewriteRule ^(\.|\w+\.(json|lock|log)) - [F,L,NC]
  RewriteRule ^index[^./]+\.php - [F,L,NC]
  RewriteRule ^bin/ - [F,L,NC]

  # Serve existing files.
  RewriteCond %{REQUEST_FILENAME} -f
  RewriteRule ^ - [L]

  # Split the REQUEST_URI into a BASE_URI and a PATH.
  RewriteRule ^(.*) - [E=PATH:/$1]
  RewriteCond %{REQUEST_URI}%{ENV:PATH} ^(.*?)(.+)\2$
  RewriteRule ^ - [E=BASE_URI:%1]

  # Serve static files (assets) on virtual URIs that are not markdown source.
  # Note: assets are served relative to /src.
  RewriteCond %{REQUEST_FILENAME} ^(.*?)/([^/]+)$
  RewriteCond %1/src%{ENV:PATH} -f
  RewriteCond %{ENV:PATH} .*(?<!\.md)$
  RewriteRule ^ %{ENV:BASE_URI}/src%{ENV:PATH} [L]

  # Call the front-controller.
  RewriteRule ^ %{ENV:BASE_URI}/index.php [L]

</IfModule>

# Disable multiviews to prevent interference with virtual routing.
<IfModule mod_negotiation.c>
    Options -MultiViews
</IfModule>

# Compress some file types.
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/json text/javascript application/javascript
</IfModule>