# Areative POS — production hardening + clean URLs (Apache)

Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block direct access to sensitive paths
  RewriteRule ^includes/ - [F,L]
  RewriteRule ^logs/ - [F,L]
  RewriteRule ^.*\.sql$ - [F,L]
  RewriteRule ^Sein\ Project\.txt$ - [F,L]
  RewriteRule ^composer\.(json|lock)$ - [F,L]

  # Skip real files and directories (assets, sw.js, etc.)
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Clean routes
  RewriteRule ^logout/?$ index.php?action=logout [L,QSA]
  RewriteRule ^([a-z0-9_]+)/?$ index.php?page=$1 [L,QSA]
</IfModule>

# Deny PHP execution in uploads-style asset folders if added later
<IfModule mod_authz_core.c>
  <FilesMatch "(?i)\.(sql|bak|env|log|ini)$">
    Require all denied
  </FilesMatch>
</IfModule>