RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Deny direct access to sensitive files
<FilesMatch "^(connection\.inc\.php|security\.php|csrf\.php)$">
  Order allow,deny
  Deny from all
</FilesMatch>

# Optional: Force HTTPS using .htaccess (instead of PHP)
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Protect .htaccess itself
<Files .htaccess>
  Order allow,deny
  Deny from all
</Files>
