# consultation-booking: only static assets and the optional JSON endpoint are public.
# Everything else in custom/ (config, CLI scripts, SQL) must not be served.
<IfModule mod_authz_core.c>
    Require all denied
    <FilesMatch "\.(css|js|svg|png|jpe?g|webp|ico)$">
        Require all granted
    </FilesMatch>
    <Files "appt-time.php">
        Require all granted
    </Files>
</IfModule>
