Options -Indexes
RewriteEngine On

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

RewriteRule (^|/)\. - [F]
RewriteRule ^_site\.php$ - [F]

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ---- SEO endpoints -------------------------------------------------------
RewriteRule ^sitemap\.xml$  /sitemap.php [L]
RewriteRule ^robots\.txt$   /robots.php  [L]
RewriteRule ^llms\.txt$     /llms.php    [L]

# ---- content routes ------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^tests/([a-z0-9]+)/?$ /tests/test.php?code=$1 [QSA,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^blog/([a-z0-9\-]+)/?$ /blog/post.php?slug=$1 [QSA,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([a-z0-9\-]+)/?$ /page.php?slug=$1 [QSA,L]

# Managed redirects and the 404 page both run through here.
ErrorDocument 404 /404.php
