# Deny direct HTTP access to all PHP files under /vendor/
# (Composer dependencies should only be loaded via the plugin's autoloader)
<FilesMatch "\.(php)$">
    Require all denied
</FilesMatch>

# Apache 2.2 fallback
<IfModule !mod_authz_core.c>
    <FilesMatch "\.(php)$">
        Order Deny,Allow
        Deny from all
    </FilesMatch>
</IfModule>
