# ---- Clean URLs: /admin, /affiliate/login etc. work without .php ----
RewriteEngine On

# Map an extensionless URL to its .php file when that file exists.
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.+?)/?$ $1.php [L]

# ---- Protect secrets / internals ----
<FilesMatch "^(config\.php|schema\.sql)$">
    Require all denied
</FilesMatch>
RedirectMatch 403 ^.*/lib/.*$
RedirectMatch 403 ^.*/\.cache/.*$
RedirectMatch 403 ^.*/(config|schema)$

Options -Indexes -MultiViews
