# Logs and session files are never served, whatever the hosting layout.
# Apache 2.4 uses Require; 2.2 shared hosts still need the Order/Deny form, and
# hitting them with 2.4-only syntax returns 500 on every request under storage/.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
