# Block direct browser access to sensitive files and folders.
<FilesMatch "^(config\.php|credentials\.json)$">
    Require all denied
</FilesMatch>

<IfModule mod_alias.c>
    RedirectMatch 403 ^/sessions/
</IfModule>
