Options -Indexes
DirectoryIndex index.php index.html
RewriteEngine On

# Block direct access to sensitive application files.
RewriteRule ^(includes|database|storage)/ - [F,L]
RewriteRule ^(config\.php|README\.md|CREDITS\.md)$ - [F,L]

# Pretty public URLs.
RewriteRule ^home/?$ index.php?page=home [L,QSA]
RewriteRule ^about/?$ index.php?page=about [L,QSA]
RewriteRule ^contact/?$ index.php?page=contact [L,QSA]
RewriteRule ^shop/?$ index.php?page=shop [L,QSA]
RewriteRule ^product/([a-z0-9-]+)/?$ index.php?page=product&slug=$1 [L,QSA]
RewriteRule ^cart/?$ index.php?page=cart [L,QSA]
RewriteRule ^checkout/?$ index.php?page=checkout [L,QSA]
RewriteRule ^order-success/?$ index.php?page=order-success [L,QSA]
RewriteRule ^terms/?$ index.php?page=terms [L,QSA]
RewriteRule ^privacy/?$ index.php?page=privacy [L,QSA]
RewriteRule ^sitemap\.xml$ sitemap.php [L,QSA]

# Existing files and directories are served normally.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^ index.php?page=not-found [L,QSA]

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>
