# Don't leak PHP errors to the browser in production.
php_flag display_errors off

# Only config.php needs protecting from direct access — it has no output of
# its own anyway since it's always required from another script, but this
# blocks anyone probing for it directly.
<Files "config.php">
    Require all denied
</Files>
