# Nothing in this directory is ever served over HTTP.
#
# The application reads these files from disk; the web server must not.
# This lives here rather than in the parent .htaccess because <Files>
# rules cascade into subdirectories — a blanket rule upstairs also blocks
# public/index.php and 403s the entire site.

Require all denied

# Apache 2.2 fallback (older cPanel boxes).
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
