Options -Indexes

# ── Security: block direct access to sensitive files ─────────
<FilesMatch "(^\.env|config\.php|schema\.sql|\.env\.example)">
  Require all denied
</FilesMatch>

<DirectoryMatch "includes/">
  Require all denied
</DirectoryMatch>

# ── Rewrite engine ────────────────────────────────────────────
RewriteEngine On
RewriteBase /

# ── Clean URLs ────────────────────────────────────────────────
RewriteRule ^article/([a-z0-9\-]+)/?$   article.php?slug=$1  [L,QSA]
RewriteRule ^section/([a-z0-9\-]+)/?$   section.php?s=$1     [L,QSA]
RewriteRule ^staff/?$                    staff.php             [L]
RewriteRule ^staff/([a-z0-9\-]+)/?$     staff.php?slug=$1    [L,QSA]
RewriteRule ^about/?$                    about.php             [L]
RewriteRule ^rss/?$                      rss.php               [L]
RewriteRule ^search/?$                   search.php            [L,QSA]

# ── Skip rewrite for real files, dirs, api, admin, assets ────
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI}      !^/api/
RewriteCond %{REQUEST_URI}      !^/admin/
RewriteCond %{REQUEST_URI}      !^/assets/
RewriteCond %{REQUEST_URI}      !^/uploads/

RewriteRule ^$ index.php [L]
