RewriteEngine On

# Serve existing files/directories directly (css, js, images, uploads)
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Everything else goes through the front controller
RewriteRule ^ index.php [L]

# Security: block direct access to sensitive file types inside public/uploads
<FilesMatch "\.(php[0-9]?|phtml)$">
    <If "%{REQUEST_URI} =~ m#^/uploads/#">
        Require all denied
    </If>
</FilesMatch>

Options -Indexes
