Options -Indexes

# Block JSON files from direct browser access
<FilesMatch "\.json$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Allow images (QR, welcome) to be viewed in admin panel
<FilesMatch "\.(jpg|jpeg|png|webp)$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

# Extra: block direct access to mapi flag files
<FilesMatch "^\.mapi_">
  Order deny,allow
  Deny from all
</FilesMatch>
