# Ragreen - protects files that must never be served directly.
# This matters because the whole project folder is typically dropped into
# htdocs/ as one unit (see README setup instructions), which means anything
# under it is web-reachable by default unless explicitly blocked here.

# Block .env, .env.example, .git*, and any other dotfile from being downloaded.
# .php files (config.php etc.) are safe even without this - Apache executes
# them rather than serving their source - but .env is plain text and MUST
# be blocked, since it now holds real database credentials.
<FilesMatch "^\.">
    # Apache 2.4+
    Require all denied
</FilesMatch>

<IfModule !mod_authz_core.c>
    # Apache 2.2 fallback (older shared hosting)
    <FilesMatch "^\.">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
