# Single-page app (Vite build). Restored 2026-09-22 after the intrusion
# replaced this file with a WordPress rewrite pointing at a deleted index.php.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Existing files and directories are served directly.
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Everything else is handled by the app's entry point.
  RewriteRule . /index.html [L]
</IfModule>

# No PHP is used by this site, so no PHP file here may execute.
<FilesMatch "\.(php[0-9]?|phtml|phar|pht|phps)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# Never serve app internals, data or environment files.
<FilesMatch "^(\.env.*|database\.sqlite|package(-lock)?\.json|.*\.log)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>