# Backups contain full post content plus commenter names/emails — unlike /uploads/, nothing
# in here is meant to be visitor-facing, so this denies ALL direct access outright (not just
# PHP execution). Admin retrieval goes through admin/backup-file-download.php, which reads
# the file server-side after checking the session, rather than the browser hitting it by URL.
<IfModule mod_authz_core.c>
    # Apache 2.4+
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    # Apache 2.2
    Order allow,deny
    Deny from all
</IfModule>
