# FamilyGuard - Apache rewrite (root of api subdomain)
# Upload all files under backend/ to the api subdomain's public_html root.
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ api/index.php [QSA,L]

# Block direct HTTP access to sensitive files
<FilesMatch "^(config\.php|config\.php\.bak|\.htaccess)$">
    Require all denied
</FilesMatch>