Options -Indexes

# Deny dotfiles — notably the install lock, which lands here when the project
# root is also the document root. Apache 2.4 uses Require; 2.2 shared hosts
# still need the Order/Deny form, and hitting them with 2.4-only syntax
# returns 500 on every request under /install.
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# lib.php is an include, never an entry point.
<Files "lib.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
