# ==========================================================================
# DI RevNexus — Apache configuration
# Removes the .php extension from URLs (e.g. /services instead of
# /services.php) while keeping the underlying .php files working.
# ==========================================================================

RewriteEngine On

# ---------------------------------------------------------------
# 1) If someone requests a URL WITH the .php extension directly,
#    redirect them (301) to the clean, extension-less version.
#    e.g. /services.php  ->  /services
#    This avoids duplicate-content and keeps one canonical URL.
#
#    IMPORTANT: never redirect POST requests. A 301/302 redirect
#    causes browsers to replay the follow-up request as a GET,
#    silently dropping the form body — which broke the contact
#    form, the popup form, and the admin reply tool's login (all
#    POST directly to their *.php handler, e.g. contact-submit.php).
#    GET requests (normal page loads/links) are unaffected and still
#    get the clean-URL redirect as before.
# ---------------------------------------------------------------
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{THE_REQUEST} \s/+(.+?)\.php[\s?] [NC]
RewriteRule ^ /%1 [R=301,L]

# ---------------------------------------------------------------
# 2) Internally serve the matching .php file for a clean URL,
#    without changing what shows in the browser's address bar.
#    e.g. /services  ->  services.php  (served, not redirected)
# ---------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L]

# ---------------------------------------------------------------
# 3) Remove trailing slashes (e.g. /services/ -> /services)
# ---------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [R=301,L]

# ---------------------------------------------------------------
# 4) Send the homepage's clean root URL (/) to index.php
# ---------------------------------------------------------------
DirectoryIndex index.php

# ---------------------------------------------------------------
# Basic hardening / hygiene
# ---------------------------------------------------------------
Options -Indexes
ServerSignature Off

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>

# Custom error pages fall back to the site if not present
ErrorDocument 404 /index.php

# ---------------------------------------------------------------
# Block direct browser access to /includes/ — this is where the
# SMTP credentials and admin-tool password live (mailer-config.php).
# These files are only ever loaded server-side via PHP require, never
# requested directly, so there is no legitimate reason to allow it.
# ---------------------------------------------------------------
RewriteRule ^includes/ - [F,L]

# ---------------------------------------------------------------
# Keep the internal admin reply tool out of search engines. It is
# not linked from anywhere on the public site and is protected by
# its own password-gated login — this header is defense in depth,
# not a substitute for that login.
# ---------------------------------------------------------------
<IfModule mod_headers.c>
    <If "%{REQUEST_URI} =~ m#^/admin/#">
        Header set X-Robots-Tag "noindex, nofollow"
    </If>
</IfModule>
