# Deny all web access to configuration files. Config is only ever
# read from PHP via bootstrap/app.php, never served directly.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Deny from all
</IfModule>
