# Deny direct web access to files that hold secrets or internal data.
# These are only ever include()d by the app — never requested directly — so
# blocking URL access to them is safe and prevents source/secret disclosure
# (e.g. if PHP is ever misconfigured and serves .php as text).

<FilesMatch "^(config|db_config)\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block the CA bundle, any JSON, and gzipped backups from being fetched.
<FilesMatch "\.(json|gz|pem)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>