# Deny all direct web requests to inc/ and its descendants on Apache.
# PHP include/require from the upgrader still works. On Nginx, add an
# equivalent server rule before exposing the upgrader to the internet.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order Deny,Allow
  Deny from all
</IfModule>
