# Underscore-prefixed files here are includes, meant to be pulled in by the
# endpoints in this folder and never requested directly:
#
#   _bootstrap.php          - the method/CSRF front gate
#   _readonly_endpoints.php - the data-only exemption list it reads
#
# Requesting either directly is harmless anyway (the gate would reject it, and
# the list only defines a constant), so this is defence in depth rather than the
# thing keeping them safe. It is also Apache-only - like every .htaccess, it is
# silently ignored on nginx, IIS and LiteSpeed, which is exactly why the database
# itself was moved out of the web root rather than left relying on one of these.
<FilesMatch "^_.*\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
