# Deny direct web access to config.php (credentials) and agent.php
# (a library file, never meant to be requested directly). run.php stays
# reachable since some hosts can only trigger cron over HTTP.
<FilesMatch "^(config(\.sample)?|agent|version)\.php$">
    Require all denied
</FilesMatch>

# Belt-and-braces for older Apache (mod_authz_host):
<IfModule !mod_authz_core.c>
    <FilesMatch "^(config(\.sample)?|agent|version)\.php$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
