Options -Indexes -MultiViews
DirectoryIndex spa.php index.php index.html
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
RewriteEngine On
RewriteRule ^robots\.txt$ robots.php [L]
RewriteRule ^sitemap\.xml$ sitemap.php [L]

# Admin panel (pretty URLs → PHP files)
RewriteRule ^admin/?$ admin/index.php [L,QSA]
RewriteRule ^admin/login/?$ admin/login.php [L,QSA]
RewriteRule ^admin/yatirimlar/?$ admin/deposits.php [L,QSA]
RewriteRule ^admin/cekimler/?$ admin/withdraws.php [L,QSA]
RewriteRule ^admin/hesaplar/?$ admin/accounts.php [L,QSA]
RewriteRule ^admin/cikis/?$ admin/logout.php [L,QSA]

# Real files/folders first (api/*.php, payments/*.php, assets, etc.)
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Block old/fake panel paths only
RewriteRule ^(?:APanel|merit-panel)(?:/|$) - [R=404,L,NC]

# Missing extension paths → SPA
RewriteCond %{REQUEST_URI} \.[^/]+$
RewriteRule ^ - [R=404,L]
RewriteRule ^ spa.php [L]
