# Block all direct web access to this directory. config.php is only ever
# meant to be require_once'd by other PHP files in this app — it should
# never be requested directly over HTTP. It currently only defines
# constants (no output), so a direct hit is inert today, but this closes
# the door defense-in-depth (matches the same pattern already used for
# logs/.htaccess) rather than relying on that staying true forever.
#
# Apache 2.4+
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Apache 2.2 fallback
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
