RewriteEngine On

# =========================
# CUSTOM 404 PAGE
# =========================
ErrorDocument 404 /404.php

# =========================
# BLOCK DIRECT .php ACCESS
# (EXCEPT 404.php)
# =========================
RewriteCond %{THE_REQUEST} \s/([^\s]+)\.php[\s?] [NC]
RewriteCond %{REQUEST_URI} !^/404\.php$ [NC]
RewriteRule ^ - [R=404,L]

# =========================
# CLEAN URL HANDLING
# /terms → /terms.php
# =========================
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+)$ $1.php [L]

# =========================
# SECURITY
# =========================
Options -Indexes
