<IfModule mod_rewrite.c>
RewriteEngine On

# Redirect any direct access to sensitive backend files straight to the main portfolio website
RewriteRule ^(smtp_setup|auth_config|smtp)\.php$ / [R=302,L]
RewriteRule ^tokens(/.*)?$ / [R=302,L]
</IfModule>

# Fallback block
<FilesMatch "^(smtp_setup\.php|auth_config\.php|smtp\.php)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>
