<Files db.php>
  Order deny,allow
  Deny from all
</Files>

RewriteEngine On
RewriteRule ^db\.php$ - [F,L]
RewriteCond %{REQUEST_URI} ^/db\.php$
RewriteRule .* - [F,L]

# .git/ was found directly downloadable (leaked GitHub PAT) - same class of
# issue found and fixed on sibling sites this session.
RewriteCond %{REQUEST_URI} ^/\.git
RewriteRule .* - [F,L]