diff --git a/.htaccess b/.htaccess
index 875db33..54cbc9b 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,8 +3,9 @@
     # May be required to access sub-directories
     #RewriteBase /
 
-    # Deny access to internal dirs by passing the URL to Pico
-    RewriteRule ^(.git|config|content|content-sample|lib|vendor)(/|$) index.php [L]
+    # Deny access to internal dirs and files by passing the URL to Pico
+    RewriteRule ^(\.git|config|content|content-sample|lib|vendor)(/|$) index.php [L]
+    RewriteRule ^(CHANGELOG.md|composer.(json|lock)) index.php [L]
 
     # Enable URL rewriting
     RewriteCond %{REQUEST_FILENAME} !-f