Options -MultiViews
RewriteEngine On

# Dynamic sitemap with a stable search-engine URL.
RewriteRule ^sitemap\.xml$ sitemap.php [L,NC]

# Private application folders must not be exposed over HTTP. In particular,
# data/ can contain account, order and payment records during migration.
RewriteRule ^(?:app|config|data|database|includes)(?:/|$) - [F,L,NC]
RewriteRule ^uploads/proofs(?:/|$) - [F,L,NC]

# Public application folders must not be treated as language paths. Without
# this exclusion, /admin/index.php can match the generic language pattern and
# open the public homepage with "admin" used as a locale.
RewriteRule ^(?:admin|api|assets|uploads)(?:/|$) - [L,NC]

# Localized public routes. English keeps the normal .php URL; all active
# non-English languages use /de/page/ or /fr/page/. The PHP pages receive a
# locale internally without exposing query strings to customers or Google.
RewriteRule ^([a-zA-Z]{2,8})/?$ index.php?locale=$1 [L,QSA,NC]
RewriteRule ^([a-zA-Z]{2,8})/([A-Za-z0-9_-]+)\.php$ $2.php?locale=$1 [L,QSA,NC]
RewriteRule ^([a-zA-Z]{2,8})/([A-Za-z0-9_-]+)/?$ $2.php?locale=$1 [L,QSA,NC]
