# Defense-in-depth: these files are only ever included by other PHP scripts
# (via require), never requested directly — block direct web access to them.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
