<IfModule mod_rewrite.c>
    RewriteEngine On

    # --- Force HTTPS and www ---
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} !^www\.creativedigitalinfotech\.com$ [NC]
    RewriteRule ^(.*)$ https://www.creativedigitalinfotech.com/$1 [L,R=301]

    # --- Remove trailing slashes (except root or directories) ---
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)/$ /$1 [R=301,L]

    # --- Remove .php extension from URLs ---
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^([^/]+)/?$ $1.php [L]

    # --- SEO-friendly job URLs like /seo-executive-job ---
    RewriteRule ^([a-zA-Z0-9-]+)-job$ apply-now.php?job=$1 [L,QSA]

    # --- Custom 404 page ---
    ErrorDocument 404 /404.php
</IfModule>

<IfModule mod_headers.c>
    Header unset X-Powered-By
</IfModule>

# --- Hide server signature ---
ServerSignature Off

# --- Disable directory listing ---
Options -Indexes

# --- Block access to sensitive files ---
<FilesMatch "\.(htaccess|env|git|ini|log|sh|bak|sql|swp|swo|save|orig|old)$">
    Require all denied
</FilesMatch>

# --- Block direct access to config and private PHP files ---
<FilesMatch "^(config|database|secrets)\.php$">
    Require all denied
</FilesMatch>

# --- Block access to hidden dotfiles (.env, .git, etc.) ---
<Files ~ "^\.">
    Require all denied
</Files>

# --- Protect uploads directory ---
<Directory "/var/www/html/uploads">
    # Prevent PHP execution
    <FilesMatch "\.(php|php5|phtml|phar)$">
        Require all denied
    </FilesMatch>

    # Optional: block script-like files
    <FilesMatch "\.(pl|py|cgi|exe|jsp|asp|aspx|sh)$">
        Require all denied
    </FilesMatch>
</Directory>