RewriteEngine On # HTTP -> HTTPS RewriteCond %{HTTPS} !=on RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] # sitemap.xml -> sitemap.php RewriteRule ^sitemap\.xml$ sitemap.php [L] # .php ile gelenleri uzantısız URL’ye yönlendir RewriteCond %{THE_REQUEST} \s/+(.+?)\.php[\s?] [NC] RewriteRule ^ %1 [R=301,L] # Block access to SQL files RewriteRule \.sql$ - [F,L] # Block access to sensitive directories RewriteRule ^database/ - [F,L] RewriteRule ^migrations/ - [F,L] RewriteRule ^_html/ - [F,L] RewriteRule ^portfolio-reference/ - [F,L] # Block root admin stub files RewriteRule ^(biography|contact-settings|event-form|form|gallery-form|gallery|language-form|languages|media|music-form|music|redirect-form|redirects|seo-settings|settings|social-form|social|table|user-form|users|video-form|videos|index_admin_backup)\.php$ - [F,L] # Clean URLs: /about -> /about.php RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME}.php -f RewriteRule ^(.+?)/?$ $1.php [L] # Custom error pages ErrorDocument 404 /404.php # Production error settings php_flag display_errors off php_flag log_errors on Require all denied Require all denied