# Block directory listing and sensitive files
Options -Indexes

<FilesMatch "\.(sql|md|lock|log|ini|sample\.php)$">
  Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Pretty tracking URL: /track/TRK-XXXX  (route added with the public site)
  # RewriteRule ^track/([A-Za-z0-9-]+)/?$ track.php?tn=$1 [L,QSA]
</IfModule>
