# Required by the PrestaShop Addons validator (security): no direct access to module files.
# Same rules as PrestaShop 9 uses for /modules, so PS 8 shops get the same protection.
# Front controllers, AJAX and cron go through index.php?fc=module (conventions SEC-06).
<FilesMatch "(\.php|\.log|\.txt|\.lock|\.json|\.yml|\.yaml|\.tpl|\.twig|\.neon|\.dist|\.md|config\.xml|config_([a-z]+)\.xml)$">
    # Apache 2.2
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>

    # Apache 2.4
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>
