<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# Block direct access to anything that isn't index.php in this directory
<FilesMatch "^(?!index\.php$).*\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

Options -Indexes