RewriteEngine On

# Block access to includes and scripts
RewriteRule ^includes/ - [F,L]
RewriteRule ^scripts/ - [F,L]

# Clean API URLs
RewriteRule ^api/verify$ api/verify.php [L,QSA]
RewriteRule ^api/admin/stats$ api/admin/stats.php [L,QSA]
RewriteRule ^api/admin/items$ api/admin/items.php [L,QSA]
RewriteRule ^api/admin/logs$ api/admin/logs.php [L,QSA]
RewriteRule ^api/admin/suspicious$ api/admin/suspicious.php [L,QSA]

# Clean admin URLs (optional)
RewriteRule ^admin/dashboard/?$ admin/dashboard.php [L,QSA]
RewriteRule ^admin/items/?$ admin/items.php [L,QSA]
RewriteRule ^admin/logs/?$ admin/logs.php [L,QSA]
RewriteRule ^admin/suspicious/?$ admin/suspicious.php [L,QSA]
RewriteRule ^admin/login/?$ admin/login.php [L,QSA]
RewriteRule ^admin/logout/?$ admin/logout.php [L,QSA]
RewriteRule ^admin/?$ admin/dashboard.php [L,QSA]
