# =============================================================================
#  Protection for the api/ folder  --  goes into public_html/api/.htaccess
# =============================================================================

Options -Indexes

# Backup files and anything that is not an endpoint are never served.
# Without this, api/_api_inc.php.bak would download as plain text, database
# credentials included.
<FilesMatch "\.(bak|old|save|orig|copy|swp|swo|sql|zip|gz|tar|txt|log|json|md|ini|conf|dist|example|sample|~)$">
    Require all denied
</FilesMatch>

<FilesMatch "~$">
    Require all denied
</FilesMatch>

# _api_inc.php is pulled in by the other endpoints through require_once (at the
# filesystem level, not over HTTP), so it has no reason to be reachable.
<Files "_api_inc.php">
    Require all denied
</Files>

<FilesMatch "^\.">
    Require all denied
</FilesMatch>
