# Block direct web access to config and PHP includes.
<FilesMatch "^config\.php$">
  Require all denied
</FilesMatch>
<IfModule mod_rewrite.c>
  RewriteEngine On
  # deny the includes directory
  RewriteRule ^includes/ - [F,L]
  RewriteRule ^schema\.sql$ - [F,L]
  RewriteRule ^config\.example\.php$ - [F,L]
</IfModule>
