# Belt-and-suspenders: config.php/database.php only ever *execute* as PHP
# under a correctly configured web server (source is never sent to the
# client), but this blocks direct requests outright so a misconfigured
# server (PHP handler disabled/mismatched) can never leak DB credentials
# or app secrets as plain text.
Require all denied

<IfModule !mod_authz_core.c>
  Order deny,allow
  Deny from all
</IfModule>
