# Deny all direct web access to files in this directory.
# Require all denied (Apache 2.4+) blocks the request before PHP-FPM is involved.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Deny from all
</IfModule>

# Belt-and-suspenders: disable PHP execution via mod_php if present.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# Prevent directory listing and server-side includes.
Options -ExecCGI -Indexes -Includes
