<IfModule mod_rewrite.c>
    RewriteEngine On

    # ─── Redirect everything to the public/ folder ───
    # This silently forwards all requests to public/index.php
    # while keeping the URL clean in the browser.

    # If a real file exists at root (e.g. ads.txt, robots.txt, 
    # google-site-verification.html), serve it directly
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]

    # Otherwise, forward to the public/ folder
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# ─── Deny direct access to sensitive files/folders ───
<FilesMatch "\.(env|log|sql|md|json|lock|gitignore)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block access to hidden files (except .htaccess itself)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule (^|/)\.(?!htaccess) - [F]
</IfModule>

# Prevent directory listing
Options -Indexes
