web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Allow access to all files in assets/ and common/images/" stopProcessing="true">
          <match url="^(assets|common/images)/" ignoreCase="false" />
          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" />
          </conditions>
          <action type="None" />
        </rule>
        <rule name="Deny access to all content in vendor/" stopProcessing="true">
          <match url="^vendor/" ignoreCase="true" />
          <action type="Rewrite" url="common/errors/handle404.php" />
        </rule>
        <rule name="Allow access to all .php files except .html.php and .inc.php" stopProcessing="true">
          <match url="\.php$" ignoreCase="false" />
          <conditions>
            <add input="{URL}" pattern="\.(html|inc)\.php$" ignoreCase="true" negate="true" />
            <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" />
          </conditions>
          <action type="None" />
        </rule>
        <rule name="Deny access to everything else" stopProcessing="true">
          <match url="." ignoreCase="false" />
          <action type="Rewrite" url="common/errors/handle404.php" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>