<IfModule mod_rewrite.c>
  RewriteEngine On

  # Normalize /site/* to / (only for direct requests).
  RewriteCond %{THE_REQUEST} \s/+site/ [NC]
  RewriteRule ^site/(.+)$ /$1 [R=301,L]

  # Block path traversal attempts
  RewriteRule \.\. - [F,L]

  # Block sensitive directories from ever being exposed
  RewriteRule ^submissions/ - [F,L]

  # Serve real files/dirs from web root first
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # If a file/dir exists under /site, serve it at /
  RewriteCond %{DOCUMENT_ROOT}/site/$1 -f [OR]
  RewriteCond %{DOCUMENT_ROOT}/site/$1 -d
  RewriteRule ^(.+)$ /site/$1 [L]

  # Fall back to the front controller
  RewriteRule ^ index.php [L]
</IfModule>
