# BotCom Relay — deny direct access to sensitive files.
<FilesMatch "^(config\.php|schema\.sql|README\.txt|\.htaccess)$">
    Require all denied
</FilesMatch>

# Force PHP execution (shared hosts sometimes serve .php as text).
<FilesMatch "\.php$">
    SetHandler application/x-httpd-php
</FilesMatch>

# No directory listing.
Options -Indexes
