.htaccess

# redirect to public page
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{REQUEST_URI} !^public$
    RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge [NC]
    RewriteRule "^(.*)$" "/public/" [R=301,L]

    # If you installed CodeIgniter in a subfolder, you will need to
    # change the following line to match the subfolder you need. Uncomment
    # the line below and comment the line above.
    #RewriteRule "^(.*)$"  "/[SUBDIRECTORY]/public/" [R=301,L]
</IfModule>

# disable directory browsing
# For security reasons, Option all cannot be overridden.
Options +SymLinksIfOwnerMatch -Indexes

# prevent folder listing
IndexIgnore *

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
</Ifmodule>

<IfModule authz_core_module>
  # secure htaccess file
  <Files .htaccess>
    Require all denied
  </Files>

  # prevent access to PHP error log
  <Files error_log>
    Require all denied
  </Files>

  # prevent access to LICENSE
  <Files LICENSE>
    Require all denied
  </Files>

  # prevent access to csv, txt and md files
  <FilesMatch "\.(csv|txt|md|yml|json|lock)$">
    Require all denied
  </FilesMatch>
</IfModule>