# Block direct PHP execution — files served only through api/serve.php
php_flag engine off
<FilesMatch "\.php$">
  Deny from all
</FilesMatch>
