26 lines
807 B
ApacheConf
26 lines
807 B
ApacheConf
# Deny direct web access to files that hold secrets or internal data.
|
|
# These are only ever include()d by the app — never requested directly — so
|
|
# blocking URL access to them is safe and prevents source/secret disclosure
|
|
# (e.g. if PHP is ever misconfigured and serves .php as text).
|
|
|
|
<FilesMatch "^(config|db_config)\.php$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# Block the CA bundle, any JSON, and gzipped backups from being fetched.
|
|
<FilesMatch "\.(json|gz|pem)$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|