# The admin panel needs PHP, but the bootstrap helper must never be
# reachable directly (it only guards session/auth; blocking is defense
# in depth on top of require_admin()).
<FilesMatch "^_bootstrap\.php$">
  Require all denied
</FilesMatch>
Options -Indexes
