# These files are PHP includes, not entry points — block direct access
# as defense in depth (they don't echo secrets if hit directly, but there's
# no reason to allow it).
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Deny from all
</IfModule>
