I'm having a rough day into Apache's .htaccess manipulation methods and it seems I hit a wall. My code intends to redirect all requests to /index.php just except for file requests, simple as that. I've been fairly reading other people's examples and documentation on every relatable statements and options to replicate the desired behavior.

So far this is the code:

RewriteEngine on

# If a requested file exists, rewrite route to the file
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ %{REQUEST_FILENAME} [L]

# If a requested file does not exist, rewrite route to index.php, works even if none was requested
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ /index.php [L,QSA]

So far this is working properly, I can create virtual paths with my PHP controllers and still validate queries thanks to QSA.

The unexpected, though, comes when I decided to log the REQUEST_URI for each time /index.php was being called, to find that by trying to acces a file that does NOT exist, it's logging a call to /index.php, and at this point I don't know any techniques to apply a condition to this case.

My question in a single sentence is: How can I implement such a RewriteCond that validates if what is being requested is a file, rather than if it exists?

In addition, since it's my first time manually controlling URI requests, is there any security measures or strong suggestions I should take in account when using this rules in .htaccess?