# Nobody reaches this folder through a browser URL, ever.
# All files must be served through download.php, which checks
# the session and logs who took what.
Require all denied

# Fallback syntax for older Apache (2.2) — harmless if unused
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
