RewriteEngine On

# Block access to dotfiles/dot-directories (.env, .git, .github, .claude, etc.)
# — belt-and-suspenders in case one ever ends up in the docroot.
RewriteCond %{REQUEST_URI} (^|/)\.(?!well-known)
RewriteRule ^ - [F,L]

# Skip existing files and directories
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Rewrite extensionless PHP files
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([^/.]+)/?$ $1.php [L,QSA]

# Rewrite nested PHP files
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+)/?$ $1.php [L,QSA]

DirectoryIndex login.php index.php