# Apache 2.4: pictures and internal files are never served directly,
# only through list.php and get.php with a password.
# Reachable from outside: list.php, get.php and the admin page under the
# name set in config.php (S3D_ADMIN_FILE).
# Folders private/ and galleries/ are closed by their own .htaccess.
Options -Indexes
<FilesMatch "^(config|common|hash)\.php$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(log|json|lock|txt|tmp)$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(jpe?g|jfif|jps|png|bmp|webp|gif|avif|mpo|heic|heif)$">
  Require all denied
</FilesMatch>
