# Protect configuration and schema from direct web access.
# (PHP can still include config.php from the filesystem.)
<FilesMatch "\.(sql)$">
  Require all denied
</FilesMatch>
<FilesMatch "^config(\.sample)?\.php$">
  Require all denied
</FilesMatch>

# Never cache API responses.
<IfModule mod_headers.c>
  Header set Cache-Control "no-store, max-age=0"
</IfModule>
