# Deny direct web access to log files, backup files, and other non-page artifacts
# that should never be served as plain text (they can leak server paths, SQL, or source code).
<FilesMatch "(^error_log(\s*\(\d+\))?$|\.bak$|\.log$|\.sql$|\.env$)">
    Require all denied
</FilesMatch>
