# Block direct web access – photos are served through photo.php to signed-in staff only
Require all denied
