From c244514a48590560dafe7669ffc72827800808bd Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Tue, 14 Jul 2026 15:28:53 +0200
Subject: [PATCH] Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off
---
 AGENTS.md                                   |  2 +-
 admin/templates/layout.php                  | 48 ++++++------
 admin/templates/login.php                   | 10 +--
 admin/templates/pages/config.php            |  2 +-
 admin/templates/pages/content-dir-form.php  |  2 +-
 admin/templates/pages/content-edit.php      |  8 +-
 admin/templates/pages/content-move-form.php |  2 +-
 admin/templates/pages/content-new.php       |  8 +-
 admin/templates/pages/content.php           | 26 +++----
 admin/templates/pages/dashboard.php         |  6 +-
 admin/templates/pages/media.php             |  4 +-
 admin/templates/pages/plugin-config.php     |  4 +-
 admin/templates/pages/plugins-edit.php      |  6 +-
 admin/templates/pages/plugins-new.php       |  2 +-
 admin/templates/pages/plugins.php           | 10 +--
 admin/templates/pages/theme.php             | 14 ++--
 admin/templates/pages/users.php             |  6 +-
 cms/core/class/CodePressCMS.php             | 72 ++++++++++++++----
 cms/router.php                              | 82 ++++++++++-----------
 cms/templates/assets/footer.mustache        |  2 +-
 cms/templates/assets/header.mustache        |  6 +-
 cms/templates/assets/navigation.mustache    |  2 +-
 public/.htaccess                            | 64 +++++++---------
 public/admin.php                            | 50 ++++++-------
 24 files changed, 233 insertions(+), 205 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index df99184..1e1ed16 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -5,7 +5,7 @@
 - Sessie gestart: 16 feb 2026
 
 ## Build & Run
-- **Run Server**: `php -S localhost:8080 -t public`
+- **Run Server**: `php -S localhost:8080 cms/router.php` (router nodig voor clean URLs)
 - **Lint PHP**: `find . -name "*.php" -not -path "./vendor/*" -exec php -l {} \;`
 - **Dependencies**: Composer vereist voor CommonMark. Geen NPM.
 - **Admin Console**: Toegankelijk op `/admin.php` (standaard login: `admin` / `admin`)
diff --git a/admin/templates/layout.php b/admin/templates/layout.php
index 148cf9a..b8b6fb5 100644
--- a/admin/templates/layout.php
+++ b/admin/templates/layout.php
@@ -4,8 +4,8 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>CodePress Admin</title>
-    <link rel="stylesheet" href="assets/css/bootstrap.min.css">
-    <link rel="stylesheet" href="assets/css/bootstrap-icons.css">
+    <link rel="stylesheet" href="/assets/css/bootstrap.min.css">
+    <link rel="stylesheet" href="/assets/css/bootstrap-icons.css">
     <style>
         body { background-color: #f5f6fa; min-height: 100vh; }
         .admin-sidebar { background-color: #0a369d; min-height: 100vh; width: 240px; position: fixed; top: 0; left: 0; z-index: 100; }
@@ -25,8 +25,8 @@
         }
     </style>
     <?php if (in_array($route ?? '', ['content-edit', 'content-new', 'plugins-edit'])): ?>
-        <link rel="stylesheet" href="assets/codemirror/codemirror.min.css">
-        <link rel="stylesheet" href="assets/css/editor.css">
+        <link rel="stylesheet" href="/assets/codemirror/codemirror.min.css">
+        <link rel="stylesheet" href="/assets/css/editor.css">
     <?php endif; ?>
 </head>
 <body>
@@ -37,43 +37,43 @@
         </div>
         <ul class="nav flex-column mt-2">
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'dashboard' || ($route ?? '') === '' ? 'active' : '' ?>" href="admin.php?route=dashboard">
+                <a class="nav-link <?= ($route ?? '') === 'dashboard' || ($route ?? '') === '' ? 'active' : '' ?>" href="/admin/dashboard">
                     <i class="bi bi-speedometer2"></i> Dashboard
                 </a>
             </li>
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'content' || str_starts_with($route ?? '', 'content') ? 'active' : '' ?>" href="admin.php?route=content">
+                <a class="nav-link <?= ($route ?? '') === 'content' || str_starts_with($route ?? '', 'content') ? 'active' : '' ?>" href="/admin/content">
                     <i class="bi bi-file-earmark-text"></i> Content
                 </a>
             </li>
 
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'theme' ? 'active' : '' ?>" href="admin.php?route=theme">
+                <a class="nav-link <?= ($route ?? '') === 'theme' ? 'active' : '' ?>" href="/admin/theme">
                     <i class="bi bi-palette"></i> Thema
                 </a>
             </li>
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'config' ? 'active' : '' ?>" href="admin.php?route=config">
+                <a class="nav-link <?= ($route ?? '') === 'config' ? 'active' : '' ?>" href="/admin/config">
                     <i class="bi bi-sliders"></i> Configuratie
                 </a>
             </li>
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'plugins' ? 'active' : '' ?>" href="admin.php?route=plugins">
+                <a class="nav-link <?= ($route ?? '') === 'plugins' ? 'active' : '' ?>" href="/admin/plugins">
                     <i class="bi bi-plug"></i> Plugins
                 </a>
             </li>
             <li class="nav-item">
-                <a class="nav-link <?= ($route ?? '') === 'users' ? 'active' : '' ?>" href="admin.php?route=users">
+                <a class="nav-link <?= ($route ?? '') === 'users' ? 'active' : '' ?>" href="/admin/users">
                     <i class="bi bi-people"></i> Gebruikers
                 </a>
             </li>
             <li class="nav-item mt-3">
-                <a class="nav-link" href="index.php" target="_blank">
+                <a class="nav-link" href="/" target="_blank">
                     <i class="bi bi-box-arrow-up-right"></i> Website bekijken
                 </a>
             </li>
             <li class="nav-item">
-                <a class="nav-link text-warning" href="admin.php?route=logout">
+                <a class="nav-link text-warning" href="/admin/logout">
                     <i class="bi bi-box-arrow-left"></i> Uitloggen
                 </a>
             </li>
@@ -147,19 +147,19 @@
         ?>
     </main>
 
-    <script src="assets/js/bootstrap.bundle.min.js"></script>
+    <script src="/assets/js/bootstrap.bundle.min.js"></script>
     <?php if (in_array($route ?? '', ['content-edit', 'content-new', 'plugins-edit'])): ?>
-        <script src="assets/codemirror/codemirror.min.js"></script>
-        <script src="assets/codemirror/mode/markdown.min.js"></script>
-        <script src="assets/codemirror/mode/xml.min.js"></script>
-        <script src="assets/codemirror/mode/htmlmixed.min.js"></script>
-        <script src="assets/codemirror/mode/php.min.js"></script>
-        <script src="assets/codemirror/mode/clike.min.js"></script>
-        <script src="assets/codemirror/mode/css.min.js"></script>
-        <script src="assets/codemirror/mode/javascript.min.js"></script>
-        <script src="assets/codemirror/addon/edit/closebrackets.min.js"></script>
-        <script src="assets/codemirror/addon/selection/active-line.min.js"></script>
-        <script src="assets/js/editor-toolbar.js"></script>
+        <script src="/assets/codemirror/codemirror.min.js"></script>
+        <script src="/assets/codemirror/mode/markdown.min.js"></script>
+        <script src="/assets/codemirror/mode/xml.min.js"></script>
+        <script src="/assets/codemirror/mode/htmlmixed.min.js"></script>
+        <script src="/assets/codemirror/mode/php.min.js"></script>
+        <script src="/assets/codemirror/mode/clike.min.js"></script>
+        <script src="/assets/codemirror/mode/css.min.js"></script>
+        <script src="/assets/codemirror/mode/javascript.min.js"></script>
+        <script src="/assets/codemirror/addon/edit/closebrackets.min.js"></script>
+        <script src="/assets/codemirror/addon/selection/active-line.min.js"></script>
+        <script src="/assets/js/editor-toolbar.js"></script>
     <?php endif; ?>
 </body>
 </html>
diff --git a/admin/templates/login.php b/admin/templates/login.php
index 89b0755..0d006d5 100644
--- a/admin/templates/login.php
+++ b/admin/templates/login.php
@@ -4,8 +4,8 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>CodePress Admin - Login</title>
-    <link rel="stylesheet" href="assets/css/bootstrap.min.css">
-    <link rel="stylesheet" href="assets/css/bootstrap-icons.css">
+    <link rel="stylesheet" href="/assets/css/bootstrap.min.css">
+    <link rel="stylesheet" href="/assets/css/bootstrap-icons.css">
     <style>
         body { background-color: #f5f6fa; }
         .login-card { max-width: 400px; margin: 10vh auto; }
@@ -26,7 +26,7 @@
                             <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
                         </div>
                     <?php endif; ?>
-                    <form method="POST" action="admin.php?route=login">
+                    <form method="POST" action="/admin/login">
                         <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken) ?>">
                         <div class="mb-3">
                             <label for="username" class="form-label">Gebruikersnaam</label>
@@ -51,10 +51,10 @@
                 </div>
             </div>
             <p class="text-center text-muted mt-3 small">
-                <a href="index.php" class="text-decoration-none"><i class="bi bi-arrow-left"></i> Terug naar website</a>
+                <a href="/" class="text-decoration-none"><i class="bi bi-arrow-left"></i> Terug naar website</a>
             </p>
         </div>
     </div>
-    <script src="assets/js/bootstrap.bundle.min.js"></script>
+    <script src="/assets/js/bootstrap.bundle.min.js"></script>
 </body>
 </html>
diff --git a/admin/templates/pages/config.php b/admin/templates/pages/config.php
index 911e8cf..050362e 100644
--- a/admin/templates/pages/config.php
+++ b/admin/templates/pages/config.php
@@ -5,7 +5,7 @@
         <i class="bi bi-filetype-json"></i> config.json
     </div>
     <div class="card-body">
-        <form method="POST" action="admin.php?route=config">
+        <form method="POST" action="/admin/config">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="mb-3">
                 <textarea name="config_content" class="form-control font-monospace" rows="25" style="font-size: 0.9rem; tab-size: 4;"><?= htmlspecialchars($siteConfig) ?></textarea>
diff --git a/admin/templates/pages/content-dir-form.php b/admin/templates/pages/content-dir-form.php
index 0c9922a..5c098d1 100644
--- a/admin/templates/pages/content-dir-form.php
+++ b/admin/templates/pages/content-dir-form.php
@@ -20,7 +20,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="admin.php?route=content&dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/content&dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Opslaan</button>
     </div>
 </form>
diff --git a/admin/templates/pages/content-edit.php b/admin/templates/pages/content-edit.php
index 7785609..ca71cab 100644
--- a/admin/templates/pages/content-edit.php
+++ b/admin/templates/pages/content-edit.php
@@ -2,7 +2,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="admin.php?route=content-edit&file=<?= urlencode($file) ?>" id="editor-form">
+        <form method="POST" action="/admin/content-edit&file=<?= urlencode($file) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="row mb-3">
                 <div class="col-md-4">
@@ -48,7 +48,7 @@
                 <button type="submit" class="btn btn-primary">
                     <i class="bi bi-check-lg"></i> Opslaan
                 </button>
-                <a href="admin.php?route=content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
+                <a href="/admin/content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
             </div>
         </form>
     </div>
@@ -172,7 +172,7 @@ document.addEventListener('DOMContentLoaded', function () {
         document.getElementById('media-size-form').classList.add('d-none');
         document.getElementById('media-grid').classList.remove('d-none');
         pendingFile = null;
-        fetch('admin.php?route=media-list')
+        fetch('/admin/media-list')
             .then(function (r) { return r.json(); })
             .then(function (files) {
                 var grid = document.getElementById('media-grid');
@@ -288,7 +288,7 @@ document.addEventListener('DOMContentLoaded', function () {
         var formData = new FormData(form);
         formData.append('csrf_token', '<?= $csrf ?>');
 
-        fetch('admin.php?route=media', { method: 'POST', body: formData })
+        fetch('/admin/media', { method: 'POST', body: formData })
             .then(function () {
                 form.reset();
                 document.getElementById('media-upload-btn').disabled = true;
diff --git a/admin/templates/pages/content-move-form.php b/admin/templates/pages/content-move-form.php
index 1ab7221..2ff4cd1 100644
--- a/admin/templates/pages/content-move-form.php
+++ b/admin/templates/pages/content-move-form.php
@@ -28,7 +28,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="admin.php?route=content&dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/content&dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Verplaatsen</button>
     </div>
 </form>
diff --git a/admin/templates/pages/content-new.php b/admin/templates/pages/content-new.php
index 2e4173d..fd4cd1b 100644
--- a/admin/templates/pages/content-new.php
+++ b/admin/templates/pages/content-new.php
@@ -2,7 +2,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="admin.php?route=content-new&dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
+        <form method="POST" action="/admin/content-new&dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="row mb-3">
                 <div class="col-md-8">
@@ -55,7 +55,7 @@
                 <button type="submit" class="btn btn-primary" id="content-create-btn" disabled>
                     <i class="bi bi-check-lg"></i> Aanmaken
                 </button>
-                <a href="admin.php?route=content&dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
+                <a href="/admin/content&dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
             </div>
         </form>
     </div>
@@ -174,7 +174,7 @@ document.addEventListener('DOMContentLoaded', function () {
         document.getElementById('media-size-form').classList.add('d-none');
         document.getElementById('media-grid').classList.remove('d-none');
         pendingFile = null;
-        fetch('admin.php?route=media-list')
+        fetch('/admin/media-list')
             .then(function (r) { return r.json(); })
             .then(function (files) {
                 var grid = document.getElementById('media-grid');
@@ -289,7 +289,7 @@ document.addEventListener('DOMContentLoaded', function () {
         var formData = new FormData(form);
         formData.append('csrf_token', '<?= $csrf ?>');
 
-        fetch('admin.php?route=media', { method: 'POST', body: formData })
+        fetch('/admin/media', { method: 'POST', body: formData })
             .then(function () {
                 form.reset();
                 document.getElementById('media-upload-btn').disabled = true;
diff --git a/admin/templates/pages/content.php b/admin/templates/pages/content.php
index 8085ed8..09667a9 100644
--- a/admin/templates/pages/content.php
+++ b/admin/templates/pages/content.php
@@ -7,7 +7,7 @@
         <button type="button" class="btn btn-outline-secondary btn-sm me-1" data-bs-toggle="modal" data-bs-target="#createDirModal">
             <i class="bi bi-folder-plus"></i> Nieuwe map
         </button>
-        <a href="admin.php?route=content-new&dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
+        <a href="/admin/content-new&dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
             <i class="bi bi-plus-lg"></i> Nieuw bestand
         </a>
     </div>
@@ -16,7 +16,7 @@
 <div class="collapse mb-4" id="uploadForm">
     <div class="card shadow-sm">
         <div class="card-body">
-            <form method="POST" action="admin.php?route=content&dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
+            <form method="POST" action="/admin/content&dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="mb-3">
                     <label for="file" class="form-label">Bestanden selecteren</label>
@@ -38,7 +38,7 @@
     ?>
     <nav aria-label="breadcrumb" class="mb-3">
         <ol class="breadcrumb">
-            <li class="breadcrumb-item"><a href="admin.php?route=content"><i class="bi bi-house"></i></a></li>
+            <li class="breadcrumb-item"><a href="/admin/content"><i class="bi bi-house"></i></a></li>
             <?php
             $crumbPath = '';
             foreach (explode('/', $subdir) as $i => $crumb):
@@ -48,7 +48,7 @@
                     <?php if ($crumbPath === $subdir): ?>
                         <?= htmlspecialchars($crumb) ?>
                     <?php else: ?>
-                        <a href="admin.php?route=content&dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
+                        <a href="/admin/content&dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
                     <?php endif; ?>
                 </li>
             <?php endforeach; ?>
@@ -76,11 +76,11 @@
                         <tr>
                             <td>
                                 <?php if ($item['is_dir']): ?>
-                                    <a href="admin.php?route=content&dir=<?= urlencode($item['path']) ?>">
+                                    <a href="/admin/content&dir=<?= urlencode($item['path']) ?>">
                                         <i class="bi bi-folder-fill text-warning"></i> <?= htmlspecialchars($item['name']) ?>
                                     </a>
                                 <?php else: ?>
-                                    <a href="admin.php?route=content-edit&file=<?= urlencode($item['path']) ?>">
+                                    <a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>">
                                         <?php
                                         $icon = match($item['extension']) {
                                             'md' => 'bi-file-text text-primary',
@@ -104,26 +104,26 @@
                             <td class="text-muted"><?= $item['modified'] ?></td>
                             <td>
                                 <?php if ($item['is_dir']): ?>
-                                    <a href="admin.php?route=content-dir-rename&dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
+                                    <a href="/admin/content-dir-rename&dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
                                         <i class="bi bi-pencil"></i>
                                     </a>
-                                    <a href="admin.php?route=content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
+                                    <a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
                                         <i class="bi bi-arrows-move"></i>
                                     </a>
-                                    <form method="POST" action="admin.php?route=content-dir-delete&dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
+                                    <form method="POST" action="/admin/content-dir-delete&dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
                                         <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                         <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                             <i class="bi bi-trash"></i>
                                         </button>
                                     </form>
                                 <?php else: ?>
-                                    <a href="admin.php?route=content-edit&file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
+                                    <a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
                                         <i class="bi bi-pencil"></i>
                                     </a>
-                                    <a href="admin.php?route=content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
+                                    <a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
                                         <i class="bi bi-arrows-move"></i>
                                     </a>
-                                    <form method="POST" action="admin.php?route=content-delete&file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
+                                    <form method="POST" action="/admin/content-delete&file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
                                         <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                         <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                             <i class="bi bi-trash"></i>
@@ -143,7 +143,7 @@
 <div class="modal fade" id="createDirModal" tabindex="-1">
     <div class="modal-dialog">
         <div class="modal-content">
-            <form method="POST" action="admin.php?route=content-dir-create&dir=<?= urlencode($subdir) ?>">
+            <form method="POST" action="/admin/content-dir-create&dir=<?= urlencode($subdir) ?>">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="modal-header">
                     <h5 class="modal-title"><i class="bi bi-folder-plus"></i> Nieuwe map aanmaken</h5>
diff --git a/admin/templates/pages/dashboard.php b/admin/templates/pages/dashboard.php
index 2d0e0c3..c946fc6 100644
--- a/admin/templates/pages/dashboard.php
+++ b/admin/templates/pages/dashboard.php
@@ -67,9 +67,9 @@
             <div class="card-header"><i class="bi bi-lightning"></i> Snelle acties</div>
             <div class="card-body">
                 <div class="d-grid gap-2">
-                    <a href="admin.php?route=content-new" class="btn btn-outline-primary"><i class="bi bi-plus-lg"></i> Nieuwe pagina</a>
-                    <a href="admin.php?route=config" class="btn btn-outline-secondary"><i class="bi bi-sliders"></i> Configuratie bewerken</a>
-                    <a href="admin.php?route=content" class="btn btn-outline-info"><i class="bi bi-folder2-open"></i> Content beheren</a>
+                    <a href="/admin/content-new" class="btn btn-outline-primary"><i class="bi bi-plus-lg"></i> Nieuwe pagina</a>
+                    <a href="/admin/config" class="btn btn-outline-secondary"><i class="bi bi-sliders"></i> Configuratie bewerken</a>
+                    <a href="/admin/content" class="btn btn-outline-info"><i class="bi bi-folder2-open"></i> Content beheren</a>
                     <a href="index.php" target="_blank" class="btn btn-outline-success"><i class="bi bi-box-arrow-up-right"></i> Website bekijken</a>
                 </div>
             </div>
diff --git a/admin/templates/pages/media.php b/admin/templates/pages/media.php
index b63f18f..b63c10d 100644
--- a/admin/templates/pages/media.php
+++ b/admin/templates/pages/media.php
@@ -8,7 +8,7 @@
 <div class="collapse mb-4" id="uploadForm">
     <div class="card shadow-sm">
         <div class="card-body">
-            <form method="POST" action="admin.php?route=media" enctype="multipart/form-data">
+            <form method="POST" action="/admin/media" enctype="multipart/form-data">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="mb-3">
                     <label for="file" class="form-label">Bestanden selecteren</label>
@@ -53,7 +53,7 @@
                     <td class="text-muted small"><?= htmlspecialchars($file['modified']) ?></td>
                     <td><code class="small"><?= htmlspecialchars($file['url']) ?></code></td>
                     <td>
-                        <form method="POST" action="admin.php?route=media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
+                        <form method="POST" action="/admin/media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
                             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                             <input type="hidden" name="delete" value="<?= htmlspecialchars($file['name']) ?>">
                             <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
diff --git a/admin/templates/pages/plugin-config.php b/admin/templates/pages/plugin-config.php
index 1a69d16..e577a0c 100644
--- a/admin/templates/pages/plugin-config.php
+++ b/admin/templates/pages/plugin-config.php
@@ -15,14 +15,14 @@
 
     <?php if (!empty($pluginConfig)): ?>
         <div class="card-footer text-end">
-            <a href="admin.php?route=plugins" class="btn btn-secondary">Annuleren</a>
+            <a href="/admin/plugins" class="btn btn-secondary">Annuleren</a>
             <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Opslaan</button>
         </div>
     <?php endif; ?>
 </form>
 
 <div class="mt-3">
-    <a href="admin.php?route=plugins" class="btn btn-outline-secondary btn-sm">
+    <a href="/admin/plugins" class="btn btn-outline-secondary btn-sm">
         <i class="bi bi-arrow-left"></i> Terug naar plugins
     </a>
 </div>
diff --git a/admin/templates/pages/plugins-edit.php b/admin/templates/pages/plugins-edit.php
index c2027f0..cafdc7f 100644
--- a/admin/templates/pages/plugins-edit.php
+++ b/admin/templates/pages/plugins-edit.php
@@ -1,13 +1,13 @@
 <div class="d-flex justify-content-between align-items-center mb-4">
     <h2><i class="bi bi-pencil"></i> Plugin bewerken: <?= htmlspecialchars($pluginName) ?></h2>
-    <a href="admin.php?route=plugins" class="btn btn-outline-secondary btn-sm">
+    <a href="/admin/plugins" class="btn btn-outline-secondary btn-sm">
         <i class="bi bi-arrow-left"></i> Terug
     </a>
 </div>
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="admin.php?route=plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
+        <form method="POST" action="/admin/plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="d-flex justify-content-between align-items-center mb-2">
                 <span class="badge bg-secondary">PHP</span>
@@ -21,7 +21,7 @@
                 <button type="submit" class="btn btn-primary">
                     <i class="bi bi-check-lg"></i> Opslaan
                 </button>
-                <a href="admin.php?route=plugins" class="btn btn-outline-secondary">Annuleren</a>
+                <a href="/admin/plugins" class="btn btn-outline-secondary">Annuleren</a>
             </div>
         </form>
     </div>
diff --git a/admin/templates/pages/plugins-new.php b/admin/templates/pages/plugins-new.php
index 77598c8..8aa3eb8 100644
--- a/admin/templates/pages/plugins-new.php
+++ b/admin/templates/pages/plugins-new.php
@@ -34,7 +34,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="admin.php?route=plugins" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/plugins" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Aanmaken</button>
     </div>
 </form>
diff --git a/admin/templates/pages/plugins.php b/admin/templates/pages/plugins.php
index 045e326..7621995 100644
--- a/admin/templates/pages/plugins.php
+++ b/admin/templates/pages/plugins.php
@@ -1,6 +1,6 @@
 <div class="d-flex justify-content-between align-items-center mb-4">
     <h2><i class="bi bi-plug"></i> Plugins</h2>
-    <a href="admin.php?route=plugins-new" class="btn btn-primary btn-sm">
+    <a href="/admin/plugins-new" class="btn btn-primary btn-sm">
         <i class="bi bi-plus-lg"></i> Nieuwe plugin
     </a>
 </div>
@@ -113,23 +113,23 @@
                         <div class="mt-3 d-flex justify-content-between align-items-center">
                             <div class="btn-group btn-group-sm">
                                 <?php if ($plugin['has_main']): ?>
-                                    <a href="admin.php?route=plugins-edit&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
+                                    <a href="/admin/plugins-edit&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
                                         <i class="bi bi-pencil"></i>
                                     </a>
                                 <?php endif; ?>
-                                <form method="POST" action="admin.php?route=plugins-toggle&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
+                                <form method="POST" action="/admin/plugins-toggle&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
                                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                     <button type="submit" class="btn btn-sm <?= $plugin['viewable'] ? 'btn-outline-warning' : 'btn-outline-success' ?>" title="<?= $plugin['viewable'] ? 'Verbergen' : 'Tonen' ?>">
                                         <i class="bi <?= $plugin['viewable'] ? 'bi-eye-slash' : 'bi-eye' ?>"></i> <?= $plugin['viewable'] ? 'Verberg' : 'Toon' ?>
                                     </button>
                                 </form>
                                 <?php if ($plugin['has_config']): ?>
-                                    <a href="admin.php?route=plugins-config&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
+                                    <a href="/admin/plugins-config&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
                                         <i class="bi bi-gear"></i>
                                     </a>
                                 <?php endif; ?>
                             </div>
-                            <form method="POST" action="admin.php?route=plugins-delete&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
+                            <form method="POST" action="/admin/plugins-delete&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
                                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                 <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                     <i class="bi bi-trash"></i>
diff --git a/admin/templates/pages/theme.php b/admin/templates/pages/theme.php
index 79a8ab3..ff8d8ea 100644
--- a/admin/templates/pages/theme.php
+++ b/admin/templates/pages/theme.php
@@ -3,14 +3,14 @@
     <!-- Edit theme -->
     <div class="d-flex justify-content-between align-items-center mb-4">
         <h2><i class="bi bi-palette"></i> Bewerk thema: <?= htmlspecialchars($editTheme['name'] ?? $editThemeName) ?></h2>
-        <a href="admin.php?route=theme" class="btn btn-outline-secondary btn-sm">
+        <a href="/admin/theme" class="btn btn-outline-secondary btn-sm">
             <i class="bi bi-arrow-left"></i> Terug
         </a>
     </div>
 
     <div class="card shadow-sm">
         <div class="card-body">
-            <form method="POST" action="admin.php?route=theme" enctype="multipart/form-data">
+            <form method="POST" action="/admin/theme" enctype="multipart/form-data">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <input type="hidden" name="action" value="save">
                 <input type="hidden" name="theme" value="<?= htmlspecialchars($editThemeName) ?>">
@@ -150,7 +150,7 @@
                     <button type="submit" class="btn btn-primary">
                         <i class="bi bi-check-lg"></i> Opslaan
                     </button>
-                    <a href="admin.php?route=theme" class="btn btn-outline-secondary">Annuleren</a>
+                    <a href="/admin/theme" class="btn btn-outline-secondary">Annuleren</a>
                 </div>
             </form>
         </div>
@@ -169,7 +169,7 @@
     <div class="collapse mb-4" id="newThemeForm">
         <div class="card shadow-sm">
             <div class="card-body">
-                <form method="POST" action="admin.php?route=theme" class="row g-3 align-items-end">
+                <form method="POST" action="/admin/theme" class="row g-3 align-items-end">
                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                     <input type="hidden" name="action" value="create">
                     <div class="col-md-6">
@@ -233,11 +233,11 @@
                         </div>
 
                         <div class="d-flex gap-2">
-                            <a href="admin.php?route=theme&edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
+                            <a href="/admin/theme&edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
                                 <i class="bi bi-pencil"></i> Bewerken
                             </a>
                             <?php if ($themeName !== $activeTheme): ?>
-                                <form method="POST" action="admin.php?route=theme">
+                                <form method="POST" action="/admin/theme">
                                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                     <input type="hidden" name="action" value="activate">
                                     <input type="hidden" name="theme" value="<?= htmlspecialchars($themeName) ?>">
@@ -247,7 +247,7 @@
                                 </form>
                             <?php endif; ?>
                             <?php if ($themeName !== 'default'): ?>
-                                <form method="POST" action="admin.php?route=theme">
+                                <form method="POST" action="/admin/theme">
                                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                     <input type="hidden" name="action" value="delete">
                                     <input type="hidden" name="theme" value="<?= htmlspecialchars($themeName) ?>">
diff --git a/admin/templates/pages/users.php b/admin/templates/pages/users.php
index d05b8dc..a176087 100644
--- a/admin/templates/pages/users.php
+++ b/admin/templates/pages/users.php
@@ -29,7 +29,7 @@
                                 <td class="text-muted"><?= htmlspecialchars($u['created']) ?></td>
                                 <td>
                                     <!-- Change password -->
-                                    <form method="POST" action="admin.php?route=users" class="d-inline">
+                                    <form method="POST" action="/admin/users" class="d-inline">
                                         <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                         <input type="hidden" name="action" value="change_password">
                                         <input type="hidden" name="pw_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -41,7 +41,7 @@
                                         </div>
                                     </form>
                                     <?php if ($u['username'] !== $user['username']): ?>
-                                        <form method="POST" action="admin.php?route=users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
+                                        <form method="POST" action="/admin/users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
                                             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                             <input type="hidden" name="action" value="delete">
                                             <input type="hidden" name="delete_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -64,7 +64,7 @@
         <div class="card shadow-sm">
             <div class="card-header"><i class="bi bi-person-plus"></i> Gebruiker toevoegen</div>
             <div class="card-body">
-                <form method="POST" action="admin.php?route=users">
+                <form method="POST" action="/admin/users">
                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                     <input type="hidden" name="action" value="add">
                     <div class="mb-3">
diff --git a/cms/core/class/CodePressCMS.php b/cms/core/class/CodePressCMS.php
index 71762a4..7ca4b7e 100644
--- a/cms/core/class/CodePressCMS.php
+++ b/cms/core/class/CodePressCMS.php
@@ -57,6 +57,48 @@ class CodePressCMS {
         }
     }
     
+    /**
+     * Build a clean URL for a page
+     * 
+     * @param string $page Page path (e.g., 'blog/leren/artikel')
+     * @param string|null $lang Language code
+     * @param array $params Additional query parameters
+     * @return string Clean URL
+     */
+    public function buildUrl($page = 'index', $lang = null, $params = []) {
+        $lang = $lang ?: $this->currentLanguage;
+        $url = '/' . $lang;
+        if ($page && $page !== 'index') {
+            $url .= '/' . $page;
+        }
+        if (!empty($params)) {
+            $url .= '?' . http_build_query($params);
+        }
+        return $url;
+    }
+
+    /**
+     * Build a clean admin URL
+     * 
+     * @param string $route Admin route
+     * @param array $params Additional query parameters
+     * @return string Clean admin URL
+     */
+    public static function buildAdminUrl($route = '', $params = []) {
+        $url = $route ? '/admin/' . $route : '/admin';
+        if (!empty($params)) {
+            $url .= '?' . http_build_query($params);
+        }
+        return $url;
+    }
+
+    /**
+     * Build URL string for template use (non-static, with current lang context)
+     */
+    public function url($page = 'index', $extraParams = []) {
+        return $this->buildUrl($page, $this->currentLanguage, $extraParams);
+    }
+
     /**
      * Get current language from request or config
      * 
@@ -215,7 +257,7 @@ class CodePressCMS {
                     'type' => 'file',
                     'title' => $title,
                     'path' => $pathWithoutExt,
-                    'url' => '?page=' . $pathWithoutExt . '&lang=' . $this->currentLanguage
+                    'url' => $this->buildUrl($pathWithoutExt)
                 ];
             }
         }
@@ -262,7 +304,7 @@ class CodePressCMS {
                     $this->searchResults[] = [
                         'title' => $title,
                         'path' => $relativePath,
-                        'url' => '?page=' . $relativePath . '&lang=' . $this->currentLanguage,
+                        'url' => $this->buildUrl($relativePath),
                         'snippet' => $this->createSnippet($content, $query)
                     ];
                 }
@@ -297,8 +339,9 @@ class CodePressCMS {
             return $this->getSearchResults();
         }
         
-        // Check if guide is requested
-        if (isset($_GET['guide'])) {
+        // Check if guide is requested (either via ?guide or /guide clean URL)
+        $pageCheck = $_GET['page'] ?? '';
+        if (isset($_GET['guide']) || $pageCheck === 'guide') {
             return $this->getGuidePage();
         }
         
@@ -536,9 +579,9 @@ class CodePressCMS {
         // Auto-link page titles to existing content pages (but not in H1 tags)
         $body = $this->autoLinkPageTitles($body, $cleanName);
         
-        // Convert relative internal links to CMS format
-        $body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="?page=blog/$1"', $body);
-        $body = preg_replace('/href="\/([^"]+)"/', 'href="?page=$1"', $body);
+        // Convert relative internal links to clean URLs
+        $body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/blog/$1"', $body);
+        $body = preg_replace('/href="\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/$1"', $body);
         
         return [
             'title' => $title ?: $cleanName ?: 'Untitled',
@@ -578,7 +621,7 @@ class CodePressCMS {
                     return $text; // Don't link existing links, current page title, or H1 headings
                 }
                 
-                return '<a href="?page=' . $pagePath . '&lang=' . $this->currentLanguage . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
+                return '<a href="' . $this->buildUrl($pagePath) . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
             };
             
             $content = preg_replace_callback($pattern, $replacement, $content);
@@ -916,7 +959,7 @@ private function getGuidePage() {
                 $allItems[] = [
                     'name' => ucfirst($item),
                     'path' => $relativePath,
-                    'url' => '?page=' . $relativePath,
+                    'url' => $this->buildUrl($relativePath),
                     'icon' => 'bi-folder',
                     'type' => 'directory'
                 ];
@@ -929,7 +972,7 @@ private function getGuidePage() {
                 $allItems[] = [
                     'name' => $fileTitle,
                     'path' => $pathWithoutExt,
-                    'url' => '?page=' . $pathWithoutExt,
+                    'url' => $this->buildUrl($pathWithoutExt),
                     'icon' => $icon,
                     'type' => 'file'
                 ];
@@ -1021,7 +1064,7 @@ private function getGuidePage() {
             'is_homepage' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']),
             'home_active_class' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']) ? 'active' : '',
             'is_guide_page' => isset($_GET['guide']),
-            'lang_switch_url' => isset($_GET['guide']) ? '&guide' : '&page=' . $this->config['default_page'],
+            'lang_switch_url' => '',
             'author_name' => $this->config['author']['name'] ?? 'CodePress Developer',
             'author_website' => $this->config['author']['website'] ?? '#',
             'author_git' => 'https://git.noorlander.info/E.Noorlander',
@@ -1133,13 +1176,14 @@ private function getGuidePage() {
         $sidebarToggle = '<li class="breadcrumb-item sidebar-toggle-item"><button type="button" class="sidebar-toggle-btn" onclick="toggleSidebar()" title="Toggle Sidebar" aria-label="Toggle Sidebar" aria-expanded="true"><i class="bi bi-layout-sidebar-inset"></i></button></li>';
         
         if (isset($_GET['search'])) {
-            return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
+            return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
         }
         
         $page = $_GET['page'] ?? $this->config['default_page'];
         $page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');
         $page = preg_replace('/\.[^.]+$/', '', $page);
         
+        // Convert page to clean URL format for breadcrumb
         if ($page === $this->config['default_page']) {
             return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item active"><i class="bi bi-house"></i></li></ol></nav>';
         }
@@ -1148,7 +1192,7 @@ private function getGuidePage() {
         
         // Start with sidebar toggle, then home icon linking to default page (root)
         $breadcrumb .= $sidebarToggle;
-        $breadcrumb .= '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
+        $breadcrumb .= '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
         
         // Split page path and build breadcrumb items
         $parts = explode('/', $page);
@@ -1164,7 +1208,7 @@ private function getGuidePage() {
                 $breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $title . '</li>';
             } else {
                 // Parent directory - clickable link with separator
-                $breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="?page=' . $safePath . '&lang=' . $this->currentLanguage . '">' . $title . '</a></li>';
+                $breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '/' . $safePath . '">' . $title . '</a></li>';
             }
         }
         
diff --git a/cms/router.php b/cms/router.php
index 8f92129..c40f24d 100644
--- a/cms/router.php
+++ b/cms/router.php
@@ -1,59 +1,53 @@
 <?php
-// Router file for PHP development server to handle security and static files
+// Router file for PHP development server - clean URL support + static file serving
 
 $requestUri = $_SERVER['REQUEST_URI'];
 $parsedUrl = parse_url($requestUri);
-$path = $parsedUrl['path'];
+$path = $parsedUrl['path'] ?? '/';
+$path = rtrim($path, '/') ?: '/';
+$publicDir = __DIR__ . '/../public';
 
-// Block direct access to content directory
-if (strpos($path, '/content/') === 0) {
-    http_response_code(403);
-    echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
+$mimeTypes = [
+    'css' => 'text/css',
+    'js'  => 'application/javascript',
+    'svg' => 'image/svg+xml',
+    'png' => 'image/png',
+    'jpg' => 'image/jpeg',
+    'ico' => 'image/x-icon',
+    'woff' => 'font/woff',
+    'woff2' => 'font/woff2',
+    'json' => 'application/json',
+];
+
+// Serve static files from public/
+$filePath = $publicDir . $path;
+if (is_file($filePath)) {
+    $ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
+    if (isset($mimeTypes[$ext])) {
+        header('Content-Type: ' . $mimeTypes[$ext]);
+    }
+    readfile($filePath);
     return true;
 }
 
-// Block PHP execution in content directory
-if (preg_match('/\.php$/i', $path) && strpos($path, '/content/') !== false) {
-    http_response_code(403);
-    echo '<h1>403 - Forbidden</h1><p>PHP execution not allowed in content directory.</p>';
+// Admin routes: /admin/login → admin.php?route=login
+if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
+    $_GET['route'] = $m[1] ?? 'dashboard';
+    require $publicDir . '/admin.php';
     return true;
 }
 
-// Block access to sensitive files
-$sensitiveFiles = ['.htaccess', 'config.php'];
-foreach ($sensitiveFiles as $file) {
-    if (basename($path) === $file && dirname($path) === '/') {
-        http_response_code(403);
-        echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
-        return true;
+// Language-prefixed routes: /nl/page/path → index.php?lang=nl&page=page/path
+if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
+    $_GET['lang'] = $m[1];
+    $_GET['page'] = $m[2] ?? 'index';
+    if ($_GET['page'] === 'guide') {
+        $_GET['guide'] = '1';
     }
+    require $publicDir . '/index.php';
+    return true;
 }
 
-// Serve static files from engine/assets
-if (strpos($path, '/engine/') === 0) {
-    $filePath = __DIR__ . $path;
-    if (file_exists($filePath)) {
-        // Set appropriate content type
-        $extension = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
-        $mimeTypes = [
-            'css' => 'text/css',
-            'js' => 'application/javascript',
-            'svg' => 'image/svg+xml',
-            'woff' => 'font/woff',
-            'woff2' => 'font/woff2',
-            'ttf' => 'font/ttf'
-        ];
-        
-        if (isset($mimeTypes[$extension])) {
-            header('Content-Type: ' . $mimeTypes[$extension]);
-        }
-        
-        // Serve the file
-        readfile($filePath);
-        return true;
-    }
-}
-
-// Route all other requests to index.php
-include __DIR__ . '/index.php';
+// Root or unknown → index.php
+require $publicDir . '/index.php';
 return true;
\ No newline at end of file
diff --git a/cms/templates/assets/footer.mustache b/cms/templates/assets/footer.mustache
index df8239d..14b94ad 100644
--- a/cms/templates/assets/footer.mustache
+++ b/cms/templates/assets/footer.mustache
@@ -19,7 +19,7 @@
                     </div>
                     <div class="site-info">
                         <small class="text-muted">
-                            <a href="?guide&lang={{current_lang}}" class="footer-icon guide" title="{{t_guide}}">
+                            <a href="/{{current_lang}}/guide" class="footer-icon guide" title="{{t_guide}}">
                                 <i class="bi bi-book"></i>
                             </a>
                             <span class="ms-1">|</span>
diff --git a/cms/templates/assets/header.mustache b/cms/templates/assets/header.mustache
index b4b9bed..9f72b0b 100644
--- a/cms/templates/assets/header.mustache
+++ b/cms/templates/assets/header.mustache
@@ -1,6 +1,6 @@
 <header id="site-header" class="navbar navbar-expand-lg navbar-dark" style="background-color: transparent;">
     <div class="container-fluid">
-        <a class="navbar-brand" href="?page={{default_page}}&lang={{current_lang}}">
+        <a class="navbar-brand" href="/{{current_lang}}">
             <img src="/assets/icon.svg" alt="CodePress Logo" width="32" height="32" class="me-2">
             {{site_title}}
         </a>
@@ -27,7 +27,7 @@
                 <ul class="dropdown-menu dropdown-menu-end" role="menu">
                     {{#available_langs}}
                     <li role="none">
-                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
+                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
                             {{native_name}}
                         </a>
                     </li>
@@ -47,7 +47,7 @@
             <ul class="dropdown-menu dropdown-menu-end" role="menu">
                     {{#available_langs}}
                     <li role="none">
-                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
+                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
                             {{native_name}}
                         </a>
                     </li>
diff --git a/cms/templates/assets/navigation.mustache b/cms/templates/assets/navigation.mustache
index b59b192..0b1495a 100644
--- a/cms/templates/assets/navigation.mustache
+++ b/cms/templates/assets/navigation.mustache
@@ -5,7 +5,7 @@
             <div class="col">
                 <ul class="nav nav-tabs flex-wrap" role="menubar">
                     <li class="nav-item" role="none">
-                        <a class="nav-link {{home_active_class}}" href="?page={{homepage}}&lang={{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
+                        <a class="nav-link {{home_active_class}}" href="/{{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
                             <i class="bi bi-house" aria-hidden="true"></i> {{homepage_title}}
                         </a>
                     </li>
diff --git a/public/.htaccess b/public/.htaccess
index 2e1ddc4..a2e6b1c 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -1,50 +1,44 @@
 # Disable directory listing
 Options -Indexes
 
-# Security - Block access to sensitive files and directories
+# Security - Block sensitive files
 <Files ~ "^\.">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </Files>
 
 <FilesMatch "\.(ini|log|conf|config|map)$">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </FilesMatch>
 
-# Block access to backup files
 <FilesMatch "\.(backup|bak|old|orig|swp|save)$">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </FilesMatch>
 
-# URL Routing - Route all requests to index.php
 <IfModule mod_rewrite.c>
     RewriteEngine On
-    
-    # Set base directory
     RewriteBase /
-    
-    # Block direct access to PHP files in content directory
-    RewriteRule ^content/.*\.php$ - [F,L]
-    
-    # Route all non-file/non-directory requests to index.php
-    RewriteCond %{REQUEST_FILENAME} !-f
-    RewriteCond %{REQUEST_FILENAME} !-d
-    RewriteRule ^(.*)$ index.php [QSA,L]
-    
-    # Allow access to assets
+
+    # Admin routes: /admin/login → admin.php?route=login
+    RewriteRule ^admin$ admin.php?route=dashboard [L,QSA]
+    RewriteRule ^admin/(.+)$ admin.php?route=$1 [L,QSA]
+
+    # Language-prefixed page routes: /nl, /en, /nl/page/path
+    RewriteRule ^(nl|en)/?$ index.php?lang=$1 [L,QSA]
+    RewriteRule ^(nl|en)/(.+)$ index.php?lang=$1&page=$2 [L,QSA]
+
+    # Root
+    RewriteRule ^$ index.php [L]
+
+    # Serve existing static files directly
     RewriteCond %{REQUEST_FILENAME} -f
-    RewriteRule ^assets/.*$ - [L]
-    
-    # Allow access to content assets
-    RewriteRule ^content/assets/.*$ - [L]
-    
-    # Serve files from content/-assets/ via index.php
-    RewriteRule ^-assets/.*$ index.php [L]
-    
-    # Block direct access to all other content files
-    RewriteRule ^content/.*$ - [F,L]
+    RewriteRule ^ - [L]
+
+    # Block directory listing for remaining physical dirs
+    RewriteCond %{REQUEST_FILENAME} -d
+    RewriteRule ^ - [F]
+
+    # Fallback to index.php
+    RewriteRule ^(.*)$ index.php [L,QSA]
 </IfModule>
 
 # Security headers
@@ -53,21 +47,17 @@ Options -Indexes
     Header always set X-Frame-Options DENY
     Header always set X-XSS-Protection "1; mode=block"
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';"
 </IfModule>
 
-# PHP settings
 <IfModule mod_php.c>
     php_flag display_errors Off
     php_flag log_errors On
-    php_value error_log /var/log/php_errors.log
     php_value max_execution_time 30
     php_value memory_limit 128M
     php_value upload_max_filesize 10M
     php_value post_max_size 10M
 </IfModule>
 
-# Default index file
 DirectoryIndex index.php
-
-# Error handling
-ErrorDocument 404 /index.php
\ No newline at end of file
+ErrorDocument 404 /index.php
diff --git a/public/admin.php b/public/admin.php
index 2e34307..02013b3 100644
--- a/public/admin.php
+++ b/public/admin.php
@@ -2,7 +2,7 @@
 
 /**
  * CodePress Admin Console - Entry Point
- * Access via: /admin.php?route=login|dashboard|content|config|plugins|users|logout
+ * Access via: //admin/login|dashboard|content|config|plugins|users|logout
  */
 
 // Security headers
@@ -29,7 +29,7 @@ if ($route === 'login') {
 
 // All other routes require authentication
 if (!$auth->isAuthenticated()) {
-    header('Location: admin.php?route=login');
+    header('Location: /admin/login');
     exit;
 }
 
@@ -37,7 +37,7 @@ if (!$auth->isAuthenticated()) {
 switch ($route) {
     case 'logout':
         $auth->logout();
-        header('Location: admin.php?route=login');
+        header('Location: /admin/login');
         exit;
 
     case 'dashboard':
@@ -122,7 +122,7 @@ switch ($route) {
         break;
 
     default:
-        header('Location: admin.php?route=dashboard');
+        header('Location: /admin/dashboard');
         exit;
 }
 
@@ -143,7 +143,7 @@ function handleLogin(AdminAuth $auth): void
             $result = $auth->login($username, $password);
             if ($result['success']) {
                 $auth->regenerateCsrfToken();
-                header('Location: admin.php?route=dashboard');
+                header('Location: /admin/dashboard');
                 exit;
             }
             $error = $result['message'];
@@ -264,7 +264,7 @@ function handleContentEdit(AdminAuth $auth, array $config): void
     $realPath = realpath($filePath);
     $realContentDir = realpath($contentDir);
     if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0) {
-        header('Location: admin.php?route=content');
+        header('Location: /admin/content');
         exit;
     }
 
@@ -405,7 +405,7 @@ function handleContentNew(AdminAuth $auth, array $config): void
                     }
 
                     file_put_contents($filePath, $content);
-                    header('Location: admin.php?route=content&dir=' . urlencode($dir));
+                    header('Location: /admin/content&dir=' . urlencode($dir));
                     exit;
                 }
             }
@@ -454,14 +454,14 @@ function handleContentDelete(AdminAuth $auth, array $config): void
     }
 
     $dir = dirname($file);
-    header('Location: admin.php?route=content&dir=' . urlencode($dir === '.' ? '' : $dir));
+    header('Location: /admin/content&dir=' . urlencode($dir === '.' ? '' : $dir));
     exit;
 }
 
 function handleContentDirCreate(AdminAuth $auth, array $config): void
 {
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-        header('Location: admin.php?route=content');
+        header('Location: /admin/content');
         exit;
     }
 
@@ -470,7 +470,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
     $subdir = str_replace(['../', '..\\'], '', $subdir);
 
     if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
-        header('Location: admin.php?route=content&dir=' . urlencode($subdir));
+        header('Location: /admin/content&dir=' . urlencode($subdir));
         exit;
     }
 
@@ -483,7 +483,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
         }
     }
 
-    header('Location: admin.php?route=content&dir=' . urlencode($subdir));
+    header('Location: /admin/content&dir=' . urlencode($subdir));
     exit;
 }
 
@@ -498,7 +498,7 @@ function handleContentDirRename(AdminAuth $auth, array $config): void
     $realContentDir = realpath($contentDir);
 
     if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0 || !is_dir($fullPath)) {
-        header('Location: admin.php?route=content');
+        header('Location: /admin/content');
         exit;
     }
 
@@ -518,7 +518,7 @@ function handleContentDirRename(AdminAuth $auth, array $config): void
         }
 
         $parentRelative = dirname($dir);
-        header('Location: admin.php?route=content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
+        header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
         exit;
     }
 
@@ -540,7 +540,7 @@ function handleContentMove(AdminAuth $auth, array $config): void
     $realContentDir = realpath($contentDir);
 
     if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0) {
-        header('Location: admin.php?route=content');
+        header('Location: /admin/content');
         exit;
     }
 
@@ -560,7 +560,7 @@ function handleContentMove(AdminAuth $auth, array $config): void
         }
 
         $parentRelative = is_file($fullPath) ? dirname($item) : dirname($item);
-        header('Location: admin.php?route=content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
+        header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
         exit;
     }
 
@@ -598,7 +598,7 @@ function handleContentDirDelete(AdminAuth $auth, array $config): void
     }
 
     $parentDir = dirname($dir);
-    header('Location: admin.php?route=content&dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
+    header('Location: /admin/content&dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
     exit;
 }
 
@@ -833,7 +833,7 @@ function handlePluginConfig(AdminAuth $auth, array $config): void
     $messageType = '';
 
     if (empty($pluginName) || !is_dir($pluginPath)) {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -878,7 +878,7 @@ function handlePluginEdit(AdminAuth $auth, array $config): void
     $messageType = '';
 
     if (empty($pluginName) || !is_dir($pluginPath) || !file_exists($pluginFile)) {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -954,7 +954,7 @@ function handlePluginNew(AdminAuth $auth, array $config): void
                         file_put_contents($pluginPath . '/README.md', $readme);
                     }
 
-                    header('Location: admin.php?route=plugins');
+                    header('Location: /admin/plugins');
                     exit;
                 }
             }
@@ -968,7 +968,7 @@ function handlePluginNew(AdminAuth $auth, array $config): void
 function handlePluginToggle(AdminAuth $auth, array $config): void
 {
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -977,7 +977,7 @@ function handlePluginToggle(AdminAuth $auth, array $config): void
     $pluginPath = $pluginsDir . '/' . $pluginName;
 
     if (empty($pluginName) || !is_dir($pluginPath)) {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -992,14 +992,14 @@ function handlePluginToggle(AdminAuth $auth, array $config): void
         }
     }
 
-    header('Location: admin.php?route=plugins');
+    header('Location: /admin/plugins');
     exit;
 }
 
 function handlePluginDelete(AdminAuth $auth, array $config): void
 {
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -1008,7 +1008,7 @@ function handlePluginDelete(AdminAuth $auth, array $config): void
     $pluginPath = $pluginsDir . '/' . $pluginName;
 
     if (empty($pluginName) || !is_dir($pluginPath)) {
-        header('Location: admin.php?route=plugins');
+        header('Location: /admin/plugins');
         exit;
     }
 
@@ -1021,7 +1021,7 @@ function handlePluginDelete(AdminAuth $auth, array $config): void
         rmdir($pluginPath);
     }
 
-    header('Location: admin.php?route=plugins');
+    header('Location: /admin/plugins');
     exit;
 }
 
