RewriteEngine On

# Block direct access to internal folders — these have no business being
# web-reachable; everything in them is loaded via PHP include, never by URL.
# install/ is deliberately NOT blocked here: it must stay reachable once to
# run the setup wizard. It self-locks after one successful install (see
# install/installed.lock) — delete the whole /install folder once done for
# extra safety, same as the installer page itself tells you to.
RewriteRule ^(includes|config)/ - [F,L]

<FilesMatch "\.(sql|md|env)$">
  Require all denied
</FilesMatch>
