Options -Indexes
RewriteEngine On

# Canonicalize the optional www-alias to avoid separate account/passkey origins.
RewriteCond %{HTTP_HOST} ^www\.click-guide\.de$ [NC]
RewriteRule ^ https://click-guide.de%{REQUEST_URI} [R=308,L]

# Never expose application internals or secrets directly.
RewriteRule ^(?:src|sql)(?:/|$) - [F,L,NC]
RewriteRule ^site-(?:home|privacy|imprint)\.php$ - [F,L,NC]
RewriteRule ^extension(?:/|$) - [F,L,NC]
RewriteRule ^uploads(?:/|$) - [F,L,NC]
RewriteRule ^(?:config\.php|config\.example\.php|\.installed)$ - [F,L,NC]

# Existing files (installer, icons later, etc.) are served normally.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]
