Options -Indexes
DirectoryIndex index.html
RewriteEngine On
# Force HTTPS (enable after SSL is active)
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# Clean booking status URL used by the frontend
RewriteRule ^api/bookings/([A-Za-z0-9-]+)/?$ api/booking-status.php?code=$1 [QSA,L]
<FilesMatch "^(\.env|README\.md|schema\.sql|config\.php)$">
  Require all denied
</FilesMatch>
