# _bootstrap.php, _header.php, _footer.php are partials, not
# standalone pages. They assume variables already set by whichever
# tab file required them, and would emit PHP notices or a broken
# half-page if requested directly. Block direct access; they are
# only ever reached via require from dashboard.php/trends.php.
<FilesMatch "^_.*\.php$">
    Require all denied
</FilesMatch>
