<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # --- Optional: rewrite /dashboard → /index.php ---
    RewriteRule ^dashboard$ index.php [L]

    # --- Serve existing files/folders directly ---
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # --- If URI + .php exists, serve it (clean URLs) ---
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^([^/]+)$ $1.php [L]

    # --- Fallback: route everything else to index.php ---
    RewriteRule . /index.php [L]
</IfModule>


# --- Security headers ---
<IfModule mod_headers.c>
    Header unset X-Powered-By
</IfModule>
ServerSignature Off
Options -Indexes

# --- Protect critical files ---
<FilesMatch "(\.htaccess|\.env|\.git|config\.php|database\.php|secret\.php|composer\.(json|lock)|package\.json|webpack.*|yarn.*|phpunit\.xml)$">
    Require all denied
</FilesMatch>

# --- Block hidden dotfiles ---
<Files ~ "^\.">
    Require all denied
</Files>

# --- Protect index.php from direct write via URL ---
<Files "index.php">
    Require all granted
</Files>