RewriteEngine On

# Prevent directory listing
Options -Indexes

# Block access to sensitive files
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|sql|json|xml)$">
 Order Allow,Deny
 Deny from all
</FilesMatch>

# Allow access to api directory
<IfModule mod_rewrite.c>
    RewriteRule ^api/ - [L]
</IfModule>

# Remove .php extension from URL
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.*)$ $1.php [L]

# Specific routes
RewriteRule ^admin$ admin.php [L]
RewriteRule ^admin/(.*)$ admin.php [L]
RewriteRule ^result$ result.php [L]
RewriteRule ^verification$ result-verification.php [L]
RewriteRule ^cert/([0-9]+)$ cert.php?id=$1 [L]

# Handle missing pages - redirect to home
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [L]
