# Block direct browser access. These files (config.php with DB credentials,
# ajax_auth.php, header/sidebar/footer partials) are only meant to be loaded
# server-side via PHP include/require from pages in admin_panel/ - never
# requested directly by URL. This rule does not affect PHP includes.

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
