In your case you only need to add a $ behind mysite. You already block access to index.php, but your second rule matched mysite, as well as any other url that started with mysite, including mysite.php and mysite/is/awesome.gif.
RewriteEngine On # If the request sent by the browser includes index.php... RewriteCond %{THE_REQUEST} index\.php # forbid access (403) RewriteRule ^ - [F] # Then you just need a generic rule to rewrite /mysite into index.php RewriteRule ^mysite$ index.php [L]
Please note that you can use RewriteRule ^ - instead of RewriteRule ^. -. The latter one requires that there is at least 1 character while the first one matches everything, which is not a problem in this case, but might bite you later when you try to write something that is match-all.