.htaccess

# Enable rewrite engine and follow symlinks
<IfModule mod_rewrite.c>
    RewriteEngine On
    Options +FollowSymLinks

    # 1. Enforce HTTPS and remove 'www'
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} ^www\. [NC]
    RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]

    # 2. Enable extension-less file access (.php, .html)
    RewriteCond %{REQUEST_URI} !/$
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^([^.]+)$ $1.php [L]

    RewriteCond %{REQUEST_URI} !/$
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME}.html -f
    RewriteRule ^([^.]+)$ $1.html [L]

    # Route requests to the "pages" directory
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{DOCUMENT_ROOT}/pages/%{REQUEST_URI} -f [OR]
    RewriteCond %{DOCUMENT_ROOT}/pages/%{REQUEST_URI} -d
    RewriteRule ^(.*)$ pages/$1 [L]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{DOCUMENT_ROOT}/pages/%{REQUEST_URI}.php -f
    RewriteRule ^(.*)$ pages/$1.php [L]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{DOCUMENT_ROOT}/pages/%{REQUEST_URI}.html -f
    RewriteRule ^(.*)$ pages/$1.html [L]

    # 3. Block access to hidden files and directories (e.g., .git)
    RewriteRule ^(\.|\/\.) - [F,L]
</IfModule>

# 4. Security Headers
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Permitted-Cross-Domain-Policies "none"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self';"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header edit Set-Cookie ^(.*)$ $1; HttpOnly; Secure; SameSite=Strict
</IfModule>

# 5. Directory Listing Protection
<IfModule mod_autoindex.c>
    IndexOptions +FancyIndexing
    IndexIgnore *.php
</IfModule>

# 6. Protect sensitive files
<FilesMatch "\.(git|htaccess|env|ini|log|bak|sh)$">
    Require all denied
</FilesMatch>

# 7. Disable server signature
ServerSignature Off

# 8. Custom Error Pages
ErrorDocument 400 /pages/error/400.html
ErrorDocument 401 /pages/error/401.html
ErrorDocument 403 /pages/error/403.html
ErrorDocument 404 /pages/error/404.html
ErrorDocument 405 /pages/error/405.html
ErrorDocument 429 /pages/error/429.html
ErrorDocument 500 /pages/error/500.html
ErrorDocument 502 /pages/error/502.html
ErrorDocument 503 /pages/error/503.html
ErrorDocument 504 /pages/error/504.html