# Block direct access to sensitive files
<FilesMatch "\.(json|log|md)$">
    Require all denied
</FilesMatch>

# Block access to cache directory
RedirectMatch 403 ^/cache/

RewriteEngine On

# Block direct access to content folder — must go through index.php
RewriteRule ^content/ - [F,L]

# Skip real files (cache/.json already blocked above) and directories
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Route everything else to index.php
RewriteRule ^(.*)$ index.php [L,QSA]
