diff --git a/.htaccess b/.htaccess
index fbeaf2e..745dda8 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,6 +3,16 @@
 # Enable URL rewriting
 RewriteEngine On
 
+# Block sensitive paths outright. RedirectMatch/FilesMatch/Require/Order
+# directives were confirmed NOT to be honored on this LiteSpeed setup (config/,
+# includes/*.php, and .git/ were all still reachable live despite the
+# RedirectMatch rules further down) — only mod_rewrite matching on REQUEST_URI
+# is confirmed to actually work here. This must come before other rewrites.
+RewriteCond %{REQUEST_URI} ^/(\.git|config/|includes/.*\.php|install/|db/)
+RewriteRule .* - [F,L]
+RewriteCond %{REQUEST_URI} \.sql$
+RewriteRule .* - [F,L]
+
 # Force HTTPS (uncomment in production)
 RewriteCond %{HTTPS} off
 RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]