# TR4DRR — /Tradrr/Futures/.htaccess

Options -Indexes
Options -MultiViews

RewriteEngine On
RewriteBase /Tradrr/Futures/

# Block direct access to underscore-prefixed PHP files (_core, _config, _layout)
RewriteRule (^|/)_.+\.php$ - [F,L]

# Root request — hand off to index.php which redirects based on auth state
RewriteRule ^$ index.php [L]

# Serve existing files/directories directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Route clean URLs to their index.php
RewriteRule ^(.+?)/?$ $1/index.php [L]

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Protect underscore files at filesystem level too
<FilesMatch "^_">
  Order allow,deny
  Deny from all
</FilesMatch>

# No caching for PHP
<FilesMatch "\.php$">
  Header set Cache-Control "no-store, no-cache, must-revalidate"
</FilesMatch>

# Cache static assets 7 days
<FilesMatch "\.(css|js|png|jpg|jpeg|gif|svg|woff2?)$">
  Header set Cache-Control "public, max-age=604800"
</FilesMatch>
