RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]
RewriteRule ^([^\.]+)$ $1.html [NC,L]

# Disable directory listing
Options -Indexes

# Prevent access to .htaccess & sensitive files
<FilesMatch "(\.htaccess|config\.php|db\.php|error\.log\.env|csrf_token_generate\.php|validate_csrf_token\.php)">
    Order Deny,Allow
    Deny from all
</FilesMatch>
