Yes man, i only have 1 website, its a fresh new installation.
My Magento root folder is inside /var/www/html Inside this folder u can see the app, vendor, pub, bin folders.
Yes i have .htacess in app folder
<IfVersion < 2.4>
deny from all
<IfVersion >= 2.4>
Require all denied
I am using apache on Debian
Moved to a new server. The .htaccess in my app folder was missing. That did the trick.