Options -Indexes
DirectoryIndex index.php
ErrorDocument 404 /404.php

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Never rewrite something that actually exists on disk.
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Free assessment tools:  /tools/<slug>
  RewriteRule ^tools/([a-z0-9-]+)/?$ tools/view.php?t=$1 [L,QSA]

  # Public doctor profile:  /doctor/<slug>  (must not shadow the console)
  RewriteCond %{REQUEST_URI} !^/doctor/(login|logout|console|apply|profile)\.php
  RewriteRule ^doctor/([a-z0-9-]+)/?$ doctor/profile.php?slug=$1 [L,QSA]

  # Speciality, city and article routes
  RewriteRule ^consult/([a-z0-9-]+)/?$    speciality.php?slug=$1 [L,QSA]
  RewriteRule ^sexologist/([a-z0-9-]+)/?$ city.php?slug=$1       [L,QSA]
  RewriteRule ^learn/([a-z0-9-]+)/?$      post.php?slug=$1       [L,QSA]
  RewriteRule ^sitemap\.xml$              sitemap.php            [L]

  # Shop:  /shop/<slug>
  RewriteRule ^shop/([a-z0-9-]+)/?$      shop/product.php?slug=$1 [L,QSA]

  # Prescription verification — this exact path is printed on every PDF
  RewriteRule ^rx/verify/?$               rx-verify.php          [L,QSA]

  # CMS pages: /privacy, /terms, /about and anything else the team publishes.
  # Kept last so it never shadows a real route above.
  RewriteRule ^([a-z0-9-]+)/?$            page.php?slug=$1       [L,QSA]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>
