Options -Indexes
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^ index.php [L]

# Never serve hidden files or the installer's key/lock files if they were ever placed here
<FilesMatch "^\.">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>
# After HTTPS (AutoSSL) works, you may force it by removing the leading # on the next three lines:
# RewriteCond %{HTTPS} !=on
# RewriteCond %{HTTP:X-Forwarded-Proto} !=https
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
