# Deny direct access to config
<Files "config.php">
  Require all denied
</Files>
<Files "config.example.php">
  Require all denied
</Files>

# Optional: only allow POST to upload.php via rewrite rules on some hosts
