.htaccess

RewriteEngine On
RewriteBase /fake-api/
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php [QSA,L]

# Passing Authorization header to PHP’s $_SERVER[‘HTTP_AUTHORIZATION’]
SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0

# Disable directory browsing
Options -Indexes

# Hide the contents of directories
IndexIgnore *

# Deny access to filenames starting with dot(.)
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Deny access to files with defined extensions
<FilesMatch "\.(ini|psd|log|devel|json|lock|phar|example|live|md|sh)$">
   Order allow,deny
   Deny from all
</FilesMatch>