# Block direct browser access. config.php holds DB credentials; header/sidebar/
# footer/ajax_auth are partials only meant to be loaded server-side via PHP
# include/require - never requested directly by URL. This rule does not
# affect PHP includes.

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
