RewriteEngine On

# Block access to sensitive folders if they are reachable (usually not, because docroot is /public)
RewriteRule ^(app|storage|cron|sql)/ - [F,L]

# Pretty routing (optional)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
