php_value display_errors Off
php_value mbstring.http_input auto
php_value date.timezone Asia/Kuala_Lumpur
# Block direct web access to secrets and runtime files.
# check.php stays reachable (protected by ?key=CRON_SECRET).
<FilesMatch "^(config.php|state.json|mail_errors.log|telegram_errors.log)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
