# SECURITY: this directory holds full database backups (may include
# member PII, financial records, password hashes). No direct web access
# under any circumstance -- downloads must go through download_backup.php,
# which enforces authenticated admin-session access.
Require all denied

# Legacy Apache 2.2 fallback (some shared-hosting cPanel stacks still use it)
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>

# Belt-and-braces: never execute anything in here either
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
