# Do not serve dotfiles such as .env, .env.example and .gitignore.
# (This does not cover files inside .git; block that in the server config.)
# This needs "AllowOverride AuthConfig" (or All). If the server does not
# allow it, put this block in the virtual host configuration instead.
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Do not serve the development files: the tests, the packages that
# Composer and npm install, and their configuration. These files are not
# needed on the live site (see README.md).
<If "%{REQUEST_URI} =~ m#^/(vendor|node_modules|tests)(/|$)#">
  Require all denied
</If>
<FilesMatch "^(composer\.(json|lock|phar)|package(-lock)?\.json|phpunit\.xml(\.dist)?)$">
  Require all denied
</FilesMatch>