# Block direct PHP execution inside vendor/.
# Static assets (CSS, JS, fonts, images) must remain accessible so the
# Freemius SDK can load its admin UI, deactivation modal, and license dialogs.
# PHP require_once access from within WordPress is unaffected by this rule.
<Files "*.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</Files>
