# Block direct web access to configuration, schema and credential files.
# PHP includes are unaffected (they are filesystem reads, not HTTP requests).
<FilesMatch "\.(sql|ini|log|md|example\.php)$">
    Require all denied
</FilesMatch>
<Files "config.php">
    Require all denied
</Files>
<Files "db.php">
    Require all denied
</Files>
