RewriteEngine On

# Block common bots (optional)
RewriteCond %{HTTP_USER_AGENT} (bot|crawler|spider|scraper) [NC]
RewriteRule .* - [F,L]

# --------------------------------------------------------------
# 1. Serve real files & directories directly, except the root
# --------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_URI} !^/$
RewriteRule ^ - [L]

# --------------------------------------------------------------
# 2. Redirect everything else to /user/ (external redirect)
#    Exclude /admin and /user to avoid loops.
# --------------------------------------------------------------
RewriteCond %{REQUEST_URI} !^/admin [NC]
RewriteCond %{REQUEST_URI} !^/user [NC]
RewriteRule ^(.*)$ /user/$1 [R=302,L,QSA]

# --------------------------------------------------------------
# 3. Internally rewrite /user/... to .php files (optional)
# --------------------------------------------------------------
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^user/([^/]+)/?$ user/$1.php [L,QSA]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^user/([^/]+)/([^/]+)/?$ user/$1/$2.php [L,QSA]