RewriteEngine On

# Force HTTPS (optional for local, but good for deployment)
# RewriteCond %{HTTPS} off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Prevent directory listing
Options -Indexes

# Security headers
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"

# Handle clean URLs if needed (example)
# RewriteRule ^product/([0-9]+)$ product.php?id=$1 [QSA,L]
