# Deny ALL direct access to stored images and any other file in this
# folder. Images are only ever served through /img.php, which checks
# expiry/deletion before streaming — this prevents link-guessing via
# the raw storage filenames and keeps expired/deleted files from
# being reachable even if someone finds the stored_filename.

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
