# Run index.php for /admin/ rather than listing the folder.
# Kept local so the admin works even if the root .htaccess is missing.
DirectoryIndex index.php

# Never expose a file listing.
Options -Indexes

# _bootstrap.php is an include, not a page.
<FilesMatch "^_">
  Require all denied
  <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
  </IfModule>
</FilesMatch>
