# Staged WordPress import (WXR) uploads — the client's old site's full content before it's
# reviewed. Unlike /uploads/, nothing in here is meant to be visitor-facing, so this denies
# ALL direct access outright (not just PHP execution), same convention as /backups/.
<IfModule mod_authz_core.c>
    # Apache 2.4+
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    # Apache 2.2
    Order allow,deny
    Deny from all
</IfModule>
