
# Supreonix cleanup guard: prevent public access to secrets, backups, logs, DBs, and archives.
<FilesMatch "(^\.env$|\.(sql|db|log|bak|backup|zip|tar|gz)$|composer\.(json|lock)$)">
    Require all denied
</FilesMatch>

RewriteEngine On

# ── Canonical origin: HTTPS and non-www ──
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.supreonix\.com$ [NC]
RewriteRule ^ https://supreonix.com%{REQUEST_URI} [R=301,L,NE]

# ── 0. Root URL serves the home page via router ──
RewriteRule ^$ router.php?home=1 [QSA,L]

# ── 1. Route /p/{uuid} to the central router ──
RewriteRule ^p/([a-f0-9\-]{36})$ router.php [NC,QSA,L]

# Preserve legacy public URLs by sending them to canonical UUID routes.
RewriteRule ^(?:index|home)(?:\.php)?$ / [R=301,L,NE]
RewriteRule ^about(?:\.php)?$ /p/6ea39a76-b70c-4912-852f-4fd5e10d92a9 [R=301,L,NE]
RewriteRule ^services(?:\.php)?$ /p/4e8a8f8f-c700-4f7a-8bbb-12f2030797da [R=301,L,NE]
RewriteRule ^products(?:\.php)?$ /p/f93b24fb-268d-49e0-99eb-2fb90fa73e72 [R=301,L,NE]
RewriteRule ^careers(?:\.php)?$ /p/70080e2a-e4b4-4f5a-a690-9c9ae6a9c8ee [R=301,L,NE]
RewriteRule ^(?:contact|contacts)(?:\.php)?$ /p/c03ed9dd-95e7-46d1-a8b0-2211eb156f77 [R=301,L,NE]
RewriteRule ^consultation(?:\.php)?$ /p/e56a5d4a-252f-44e4-8408-6030f157a955 [R=301,L,NE]
RewriteRule ^blog(?:\.php)?$ /p/fee7dc2d-060a-40b8-b38e-daccc6039bd9 [R=301,L,NE]
RewriteRule ^privacy-policy(?:\.php)?$ /p/b7542ad9-04f1-4368-ad57-a4b79987cadf [R=301,L,NE]
RewriteRule ^terms-of-service(?:\.php)?$ /p/89d509fe-7ea5-4eee-88fc-bda5293a1b64 [R=301,L,NE]
RewriteRule ^training(?:\.php)?$ /p/993e34b6-e0e9-4c56-ab6a-f63ba5c033f7 [R=301,L,NE]
RewriteRule ^web(?:\.php)?$ /p/5c008ded-c4e4-4863-ad09-30f704b01e1c [R=301,L,NE]
RewriteRule ^IT-support(?:\.php)?$ /p/0df5257f-f1eb-4ae3-bb4d-254bf5c3f144 [R=301,L,NE]
RewriteRule ^investor(?:\.php)?$ /p/cf82dc07-eba2-4a8e-bfbb-08150685734a [R=301,L,NE]
RewriteRule ^pricing(?:\.php)?$ /p/ed3f2972-30f9-4a0d-853d-a54e5ca24ee0 [R=301,L,NE]
RewriteRule ^search(?:\.php)?$ /p/d656bc58-5e4a-4748-8cb8-12db3c5e5c1c [R=301,L,NE]
RewriteRule ^portfolio(?:\.php)?$ / [R=301,L,NE]

# ── 2. Block direct access to .php files (redirect to UUID) ──
# Exceptions: files that are NOT public pages (API endpoints, includes, utilities)
RewriteCond %{THE_REQUEST} \s/+(.*\.php)[\s?] [NC]
RewriteCond %{REQUEST_URI} !^/router\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/includes/ [NC]
RewriteCond %{REQUEST_URI} !^/callback\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/process-contact\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/process_consultation\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/mail\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/smtp\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/subscribe\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/unsubscribe\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/companyProfile\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/slots\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/reminders\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/favicon\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/hero\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/servicess\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/top_con\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/google-login\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/google-callback\.php$ [NC]
RewriteCond %{REQUEST_URI} !^/google-logout\.php$ [NC]
RewriteRule ^ / [R=301,L]

# ── 3. Old clean URLs (without .php) also redirect to home ──
# This catches /about, /careers, etc. that previously worked via extensionless rewrite
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteCond %{REQUEST_URI} !^/p/ [NC]
RewriteCond %{REQUEST_URI} !^/assets/ [NC]
RewriteRule ^ / [R=301,L]

# DO NOT REMOVE OR MODIFY. CLOUDLINUX ENV VARS CONFIGURATION BEGIN
<IfModule Litespeed>
</IfModule>
# DO NOT REMOVE OR MODIFY. CLOUDLINUX ENV VARS CONFIGURATION END

# ── Browser caching for static assets ──
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# ── Gzip/deflate compression ──
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript text/javascript image/svg+xml
</IfModule>
