diff --git a/.htaccess b/.htaccess
index cf03659..797ede9 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,16 +3,10 @@
 # App-Bausteine, Legacy-DB-Shim) und Konfigurationsdateien mit
 # Zugangsdaten duerfen nicht direkt per URL abrufbar sein.
 
-<IfModule mod_authz_core.c>
-    <DirectoryMatch "^.*/(var|database|scripts|docs|app|lib)/">
-        Require all denied
-    </DirectoryMatch>
-</IfModule>
-<IfModule !mod_authz_core.c>
-    <DirectoryMatch "^.*/(var|database|scripts|docs|app|lib)/">
-        Order allow,deny
-        Deny from all
-    </DirectoryMatch>
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{REQUEST_URI} ^/(var|database|scripts|docs|app|lib)/ [NC]
+    RewriteRule ^ - [F]
 </IfModule>
 
 <FilesMatch "^(env\.local\.php|env\.local\.example\.php|\.env.*|composer\.(json|lock))$">