<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Security: Protect sensitive configuration and database files
    <FilesMatch "^(config\.php|config\.sample\.php|\.env|\.git|composer\.json|package\.json|schema\.sql|seed\.sql)$">
        Order Deny,Allow
        Deny from all
    </FilesMatch>

    # Allow direct access to physical files and directories
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Clean URLs for content pages
    RewriteRule ^rules$ index.php?page=rules [L,QSA]
    RewriteRule ^terms$ index.php?page=terms [L,QSA]
    RewriteRule ^privacy$ index.php?page=privacy [L,QSA]
    RewriteRule ^stats$ index.php?page=stats [L,QSA]
</IfModule>

# Security Headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>

# Gzip Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>
