Options -Indexes

DirectoryIndex index.php

RewriteEngine On

ErrorDocument 404 /404.php
ErrorDocument 500 /500.php

# Security headers suitable for cPanel/Apache shared hosting.
<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

<IfModule mod_php.c>
    php_flag expose_php Off
</IfModule>
<IfModule mod_php8.c>
    php_flag expose_php Off
</IfModule>

# Block sensitive files
<FilesMatch "^(config\.php|database\.sql|\.env|composer\.(json|lock)|README.*|.*\.log|.*\.bak|.*\.sql)$">
    Require all denied
</FilesMatch>

# Allow existing files and folders to load normally
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Application routing
RewriteRule ^blogs/([A-Za-z0-9-]+)/?$ blog-single.php?slug=$1 [QSA,L]
RewriteRule ^$ index.php [QSA,L]
RewriteRule . 404.php [L]
