Hi again,similar issue with .htaccess and .htpasswd - a simple symlink and Apache happily serves the file(s) so the following lines don't really prevent this.
--- 8< ---
#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
Require all denied
</FilesMatch>
--- 8< ---
And btw: why not this?
--- 8< ---
<FilesMatch "^\.(htaccess|htpasswd)">
--- 8< ---
Regards,
Oliver
