RewriteEngine On

# Block direct access to data directory
RewriteRule ^data/ - [F,L]

# Block direct execution of include files (defense in depth — they also
# check RELAY_BOOTSTRAPPED at the top of each file).
RewriteRule ^inc/ - [F,L]
RewriteRule ^ui/.*\.php$ - [F,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]