RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^api-(.*)$ api-$1.php [L,QSA]

# Blok akses langsung ke PHP kecuali via rewrite
<FilesMatch "^api-.*\.php$">
  # Biarkan diakses via rewrite
</FilesMatch>

# Blok akses upload dari luar
RewriteRule ^uploads/ - [F,L]
