# Protect backend directory – only PHP files should be reachable
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block direct access to config files
    RewriteRule ^config/ - [F,L]
</IfModule>

# Disable directory listing
Options -Indexes

# Deny access to config files explicitly
<FilesMatch "^(db|functions)\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>
