diff --git a/.htaccess b/.htaccess
index a785288..1916e6a 100644
--- a/.htaccess
+++ b/.htaccess
@@ -31,7 +31,12 @@ Options -MultiViews
 	#RewriteRule images/.+\.(gif|jpe?g|a?png|bmp|webp) content/images/system/default/404.gif [NC,L]
 	RewriteRule images/.+\.(gif|jpe?g|png|bmp|webp) - [NC,L,R=404]
 
+	# PHP front controller
 	RewriteCond %{REQUEST_FILENAME} !-f
 	RewriteCond %{REQUEST_FILENAME} !-d
 	RewriteRule . index.php [L]
+
+    # Single PHP-entrypoint (disables direct access to .php files)
+    RewriteCond %{THE_REQUEST} ^.+?\ [^?]+\.php[?\ ] [NC]
+    RewriteRule \.php$ - [NC,L,F,R=404]
 </IfModule>
\ No newline at end of file
diff --git a/app/.htaccess b/app/.htaccess
index 0f2e6fb..a4c6fc7 100644
--- a/app/.htaccess
+++ b/app/.htaccess
@@ -1,12 +1,3 @@
-<LimitExcept GET>
-    <IfModule !mod_authz_core.c>
-		Order Allow,Deny
-		Deny from all
-	</IfModule>
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-</LimitExcept>
 <FilesMatch "\.(?:[Pp][Hh][Pp][345]?|[Pp][Hh][Tt][Mm][Ll])|(po|sql|html?)$">
 	<IfModule !mod_authz_core.c>
 		Order Allow,Deny
diff --git a/app/content/.htaccess b/app/content/.htaccess
deleted file mode 100644
index c550f63..0000000
--- a/app/content/.htaccess
+++ /dev/null
@@ -1,27 +0,0 @@
-<LimitExcept GET>
-    <IfModule !mod_authz_core.c>
-		Order Allow,Deny
-		Deny from all
-	</IfModule>
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-</LimitExcept>
-<FilesMatch "\.(?:[Pp][Hh][Pp][345]?|[Pp][Hh][Tt][Mm][Ll])|(po|sql|html?)$">
-	<IfModule !mod_authz_core.c>
-		Order Allow,Deny
-		Deny from all
-	</IfModule>
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-</FilesMatch>
-<IfModule mod_php7.c>
-    php_flag engine off
-</IfModule>
-<FilesMatch ".+\.*$">
-    SetHandler !
-</FilesMatch>
-<IfModule mod_rewrite.c>
-    RewriteRule ^.*\.php$ - [F,L]
-</IfModule>
\ No newline at end of file
diff --git a/app/importer/jobs/.htaccess b/app/importer/jobs/.htaccess
index 184b59a..3909c77 100644
--- a/app/importer/jobs/.htaccess
+++ b/app/importer/jobs/.htaccess
@@ -1,11 +1,7 @@
-<FilesMatch "\.(txt)$">
-	# Apache 2.2
-	<IfModule !mod_authz_core.c>
-		Order Allow,Deny
-		Deny from all
-	</IfModule>
-	# Apache 2.4
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule> 
-</FilesMatch>
\ No newline at end of file
+<IfModule !mod_authz_core.c>
+	Order Allow,Deny
+	Deny from all
+</IfModule>
+<IfModule mod_authz_core.c>
+	Require all denied
+</IfModule>
\ No newline at end of file
diff --git a/content/.htaccess b/content/.htaccess
index 0c013db..a4c6fc7 100644
--- a/content/.htaccess
+++ b/content/.htaccess
@@ -1,13 +1,18 @@
-<Files .*>
-	# Apache 2.2
+<FilesMatch "\.(?:[Pp][Hh][Pp][345]?|[Pp][Hh][Tt][Mm][Ll])|(po|sql|html?)$">
 	<IfModule !mod_authz_core.c>
 		Order Allow,Deny
 		Deny from all
 	</IfModule>
-	# Apache 2.4
 	<IfModule mod_authz_core.c>
 		Require all denied
-	</IfModule> 
-</Files>
-
-SetHandler default-handler
\ No newline at end of file
+	</IfModule>
+</FilesMatch>
+<IfModule mod_php7.c>
+    php_flag engine off
+</IfModule>
+<FilesMatch ".+\.*$">
+    SetHandler !
+</FilesMatch>
+<IfModule mod_rewrite.c>
+    RewriteRule ^.*\.php$ - [F,L]
+</IfModule>
\ No newline at end of file
diff --git a/content/pages/.htaccess b/content/pages/.htaccess
deleted file mode 100644
index d72d47d..0000000
--- a/content/pages/.htaccess
+++ /dev/null
@@ -1,4 +0,0 @@
-<FilesMatch "\.php$">
-Order Deny,Allow
-Deny from all
-</FilesMatch>
\ No newline at end of file
diff --git a/images/.htaccess b/images/.htaccess
index 0f2e6fb..a4c6fc7 100644
--- a/images/.htaccess
+++ b/images/.htaccess
@@ -1,12 +1,3 @@
-<LimitExcept GET>
-    <IfModule !mod_authz_core.c>
-		Order Allow,Deny
-		Deny from all
-	</IfModule>
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-</LimitExcept>
 <FilesMatch "\.(?:[Pp][Hh][Pp][345]?|[Pp][Hh][Tt][Mm][Ll])|(po|sql|html?)$">
 	<IfModule !mod_authz_core.c>
 		Order Allow,Deny
diff --git a/importing/.htaccess b/importing/.htaccess
index 327e49e..3909c77 100644
--- a/importing/.htaccess
+++ b/importing/.htaccess
@@ -1,7 +1,7 @@
 <IfModule !mod_authz_core.c>
-    Order Allow,Deny
-    Deny from all
+	Order Allow,Deny
+	Deny from all
 </IfModule>
 <IfModule mod_authz_core.c>
-    Require all denied
-</IfModule> 
\ No newline at end of file
+	Require all denied
+</IfModule>
\ No newline at end of file