DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On

# 1. Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

# 2. Force canonical domain: kenya-expo.com (no www)
RewriteCond %{HTTP_HOST} ^www\.kenya-expo\.com$ [NC]
RewriteRule ^(.*)$ https://kenya-expo.com/$1 [L,R=301,NE]

# 3. Redirect /index or /index.php to root (avoid duplicate-content homepage URLs)
RewriteRule ^index\.php$ / [R=301,L]
RewriteRule ^index/?$ / [R=301,L]

# 4. If someone requests a .php URL directly, redirect to the clean extensionless URL
RewriteCond %{THE_REQUEST} \s/+(.+)\.php[\s?] [NC]
RewriteRule ^ /%1 [R=301,L,NE]

# 5. Internally serve the .php file when a clean URL is requested (e.g. /about -> about.php)
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^([^/]+)/?$ $1.php [L]
</IfModule>

# Prevent directory listing
Options -Indexes

# Block direct access to sensitive data files (leads, config, JSON exports)
<IfModule mod_rewrite.c>
RewriteRule ^data/ - [F,L]
RewriteRule ^includes/ - [F,L]
</IfModule>

# Fallback for servers without mod_rewrite protection above
<FilesMatch "\.(json|log)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>
