# Deny all direct web access. The application is served exclusively from the
# public/ directory; this file is defence-in-depth for the case where the web
# root is ever misconfigured to point at the project root (e.g. local XAMPP
# with docroot C:\xampp\htdocs). PHP access is unaffected.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
