# Use this only if the project root is your Nginx document root.
# Preferred deployment remains: document root -> /path/to/project/public

# Block direct access to internal framework directories.
location ^~ /app/ { return 404; }
location ^~ /bootstrap/ { return 404; }
location ^~ /config/ { return 404; }
location ^~ /database/ { return 404; }
location ^~ /resources/ { return 404; }
location ^~ /routes/ { return 404; }
location ^~ /storage/ { return 404; }
location ^~ /tests/ { return 404; }
location ^~ /vendor/ { return 404; }

# Also block hidden files except ACME challenges.
location ~ /\.(?!well-known).* {
	return 404;
}