# Admin directory — disable directory listing
Options -Indexes

# Block direct access to any PHP files OTHER than index.php (auth is handled by JS + API)
# All legitimate admin PHP is in /api/ — nothing in /admin/ should be a PHP script
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>