# Only update.php is reachable from the browser; key, cache, version, lock and backups stay private.
<IfModule mod_authz_core.c>
    Require all denied
    <Files "update.php">
        Require all granted
    </Files>
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
    <Files "update.php">
        Allow from all
    </Files>
</IfModule>
