# Block direct access to sensitive directories
RewriteEngine On

# Protect config and includes from direct web access
RewriteRule ^(config|includes|admin/actions\.php)/ - [F,L]

# PHP built-in server: no .htaccess used, but this helps for Apache.
Options -Indexes
